amadan
docs: cohort-1 runbook: platform-1e's answers for the v0.28.3 session
- TO-CONFIRM 1 to 3 stay open until platform-1e posts "v0.28.3 on dev"; the tag lands on 50f5b268; any published sha256 that differs from the local build stops the release block. - 5.0a's console promote is approved: Paul's go of 2026-10-18 named "publish-identity and the console promote redone for v0.28.3"; rollback 7c1beb2d. - Dennis is out of scope (platform-1e): P3 is about reader versions against the floor, not .prev; dennis is not enrolled and is outside the census scope (census.go:100). Never install-channel on dennis. Step 7.1 adds a read-only SSM check that dennis has no /opt/carlos/system/guard/policy.json, before the report-and-floor pair; an armed policy is a STOP.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+32
−14
docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md+32 −14
CI passed — run details
CI log
=== gate ===
cd launchctx && go vet ./... && go test ./... -count=1
ok amadan.net/carlos/platform.git/launchctx 0.011s
? amadan.net/carlos/platform.git/launchctx/controlname [no test files]
? amadan.net/carlos/platform.git/launchctx/wireid [no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok github.com/carlosframework/platform 318.512s
? github.com/carlosframework/platform/cmd/changelog [no test files]
ok github.com/carlosframework/platform/cmd/console 3.168s
ok github.com/carlosframework/platform/cmd/moveprobe 93.215s
ok github.com/carlosframework/platform/cmd/zddprobe 0.705s
ok github.com/carlosframework/platform/internal/activator 249.882s
ok github.com/carlosframework/platform/internal/agentsock 0.019s
ok github.com/carlosframework/platform/internal/alerting 0.003s
ok github.com/carlosframework/platform/internal/analytics 0.019s
ok github.com/carlosframework/platform/internal/appconfig 2.523s
ok github.com/carlosframework/platform/internal/apperr 0.075s
ok github.com/carlosframework/platform/internal/applog 0.131s
ok github.com/carlosframework/platform/internal/awsinv 0.003s
ok github.com/carlosframework/platform/internal/boxchoice 0.004s
ok github.com/carlosframework/platform/internal/boxid 0.915s
? github.com/carlosframework/platform/internal/boxid/boxidtest [no test files]
? github.com/carlosframework/platform/internal/boxid/internal/signtest [no test files]
ok github.com/carlosframework/platform/internal/boxvolumes 0.008s
ok github.com/carlosframework/platform/internal/caps 0.013s
ok github.com/carlosframework/platform/internal/certwarm 0.002s
ok github.com/carlosframework/platform/internal/cgroup 0.699s
ok github.com/carlosframework/platform/internal/changelog 0.313s
ok github.com/carlosframework/platform/internal/claimactivation 0.025s
ok github.com/carlosframework/platform/internal/clamd 0.055s
? github.com/carlosframework/platform/internal/cliflag [no test files]
ok github.com/carlosframework/platform/internal/console 409.182s
? github.com/carlosframework/platform/internal/controlname [no test files]
? github.com/carlosframework/platform/internal/controlsock [no test files]
ok github.com/carlosframework/platform/internal/dbdoor 5.970s
ok github.com/carlosframework/platform/internal/dbdoor/dbdoortest 0.009s
ok github.com/carlosframework/platform/internal/dbverify 0.004s
ok github.com/carlosframework/platform/internal/dnsrec 0.003s
ok github.com/carlosframework/platform/internal/docsite 0.005s
ok github.com/carlosframework/platform/internal/domains 2.448s
ok github.com/carlosframework/platform/internal/doorkey 0.006s
ok github.com/carlosframework/platform/internal/economics 0.004s
ok github.com/carlosframework/platform/internal/edge 44.928s
? github.com/carlosframework/platform/internal/edgeproof [no test files]
ok github.com/carlosframework/platform/internal/edgesfile 0.008s
ok github.com/carlosframework/platform/internal/fleetapi 0.138s
ok github.com/carlosframework/platform/internal/gate 1.655s
ok github.com/carlosframework/platform/internal/genselect 0.015s
ok github.com/carlosframework/platform/internal/geo 0.021s
ok github.com/carlosframework/platform/internal/geoip 0.031s
ok github.com/carlosframework/platform/internal/historyreadback 0.157s
ok github.com/carlosframework/platform/internal/host 177.970s
ok github.com/carlosframework/platform/internal/hostactors 0.739s
ok github.com/carlosframework/platform/internal/hostbox 2.887s
ok github.com/carlosframework/platform/internal/hostclaim 0.561s
ok github.com/carlosframework/platform/internal/hostevidence 0.006s
ok github.com/carlosframework/platform/internal/hostexec 4.878s
ok github.com/carlosframework/platform/internal/hostfence 0.042s
ok github.com/carlosframework/platform/internal/hostfiles 10.416s
ok github.com/carlosframework/platform/internal/hostfloor 0.013s
ok github.com/carlosframework/platform/internal/hostguard 1.032s
ok github.com/carlosframework/platform/internal/hostops 1.700s
? github.com/carlosframework/platform/internal/hostops/fencerelease [no test files]
ok github.com/carlosframework/platform/internal/hostops/internal/fencerelease 0.002s
ok github.com/carlosframework/platform/internal/hostquarantine 0.002s
ok github.com/carlosframework/platform/internal/hostrelocate 0.461s
ok github.com/carlosframework/platform/internal/hostresolve 0.150s
ok github.com/carlosframework/platform/internal/hostwrite 0.002s
ok github.com/carlosframework/platform/internal/infraview 0.003s
ok github.com/carlosframework/platform/internal/instancectl 5.223s
ok github.com/carlosframework/platform/internal/instanceexec 2.724s
ok github.com/carlosframework/platform/internal/instancefs 0.005s
ok github.com/carlosframework/platform/internal/instancekey 0.004s
ok github.com/carlosframework/platform/internal/instanceupdates 0.008s
ok github.com/carlosframework/platform/internal/layout 1.568s
ok github.com/carlosframework/platform/internal/lbhealth 0.002s
ok github.com/carlosframework/platform/internal/lease 9.818s
ok github.com/carlosframework/platform/internal/lease/leasetest 0.010s
ok github.com/carlosframework/platform/internal/ledger 0.018s
ok github.com/carlosframework/platform/internal/mail 0.176s
ok github.com/carlosframework/platform/internal/maintenance 0.078s
ok github.com/carlosframework/platform/internal/maintenanceexec 5.530s
ok github.com/carlosframework/platform/internal/maintenanceguard 0.080s
ok github.com/carlosframework/platform/internal/metrics 0.005s
ok github.com/carlosframework/platform/internal/moves 21.130s
ok github.com/carlosframework/platform/internal/moves/archive 0.822s
ok github.com/carlosframework/platform/internal/objstore 0.181s
ok github.com/carlosframework/platform/internal/ops 0.176s
ok github.com/carlosframework/platform/internal/park 0.206s
ok github.com/carlosframework/platform/internal/privatefile 0.004s
ok github.com/carlosframework/platform/internal/provision 18.590s
ok github.com/carlosframework/platform/internal/publicrelease 0.007s
? github.com/carlosframework/platform/internal/regionname [no test files]
ok github.com/carlosframework/platform/internal/registry 5.455s
ok github.com/carlosframework/platform/internal/relay 7.229s
ok github.com/carlosframework/platform/internal/release 21.641s
ok github.com/carlosframework/platform/internal/rollout 3.674s
ok github.com/carlosframework/platform/internal/rolloutwords 0.003s
ok github.com/carlosframework/platform/internal/rootaws 0.007s
ok github.com/carlosframework/platform/internal/rootparticipation 0.058s
ok github.com/carlosframework/platform/internal/rootstate 0.026s
ok github.com/carlosframework/platform/internal/runs 0.584s
ok github.com/carlosframework/platform/internal/s3compat 0.005s
ok github.com/carlosframework/platform/internal/safefile 0.004s
ok github.com/carlosframework/platform/internal/schedule 2.521s
ok github.com/carlosframework/platform/internal/seeds 0.015s
ok github.com/carlosframework/platform/internal/sim/hostlife 9.370s
ok github.com/carlosframework/platform/internal/sim/litestreamfacts 4.125s
ok github.com/carlosframework/platform/internal/status 0.043s
ok github.com/carlosframework/platform/internal/steering 0.006s
ok github.com/carlosframework/platform/internal/stopevidence 0.229s
ok github.com/carlosframework/platform/internal/svcrole 0.002s
ok github.com/carlosframework/platform/internal/telemetry 0.004s
ok github.com/carlosframework/platform/internal/termfence 0.004s
ok github.com/carlosframework/platform/internal/tunnelclient 0.004s
ok github.com/carlosframework/platform/internal/unixdial 0.003s
ok github.com/carlosframework/platform/internal/updatewords 0.004s
ok github.com/carlosframework/platform/internal/usage 0.004s
ok github.com/carlosframework/platform/internal/version 0.002s
ok github.com/carlosframework/platform/internal/vet 1.561s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
linux/arm64 carlos binary: 48824482 bytes (ceiling 52000000)
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
minio: cached, digest verified
mc: cached, digest verified
minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
buckets and scoped user ready
=== RUN TestDeliveredContractMinio
=== RUN TestDeliveredContractMinio/put
=== RUN TestDeliveredContractMinio/get_round-trips_the_body
=== RUN TestDeliveredContractMinio/list_shows_the_key
=== RUN TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN TestDeliveredContractMinio/delete_removes_it
=== RUN TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
--- PASS: TestDeliveredContractMinio/put (0.00s)
--- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
--- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
--- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
--- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok github.com/carlosframework/platform/internal/objstore 0.026s
=== RUN TestT4StorageProbeMinio
2026/10/18 14:43:16 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18DFA6D1AE3D44B1, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.01s)
PASS
ok github.com/carlosframework/platform/internal/host 0.022s
minio contract: PASS
diff --git a/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md b/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md| index c99ed37f9..bd95228aa 100644 |
| --- a/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md |
| +++ b/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md |
| @@ -14,29 +14,31 @@ Prepared on 2026-10-18 for platform-1e to present. The values and state below we |
| - carlos `linux-amd64` (the operator CLI for 5.0a) sha256: **TO-CONFIRM (published?)**. Local build: `82a60203b1790771b5f3da16bc5d342327131ed30a1aae59a520f42d253369b2`. |
| - `SHA256SUMS.txt` and `SHA256SUMS.txt.sig`: **TO-CONFIRM (published?)**. The list must name `carlos_0.28.3_amd64.deb` and `carlos_0.28.3_arm64.deb` and no other `carlos_*.deb`. `publish-identity` carries both files verbatim. |
| - Console: `~/.cache/release-v0.28.3/console-linux-arm64`, 47055010 bytes, sha256 `3660b44c13080f0e9ead5f70754a11ec267d70eaab2a89e88ce256ab3437ec74`. Checked without running it: `file` says stripped aarch64; `go version -m` shows `path github.com/carlosframework/platform/cmd/console` and `-ldflags="-s -w -X github.com/carlosframework/platform/internal/version.Build=v0.28.3"`, the stamp exactly once. Never rebuild it. |
| -- Console ship version `CV`: `50f5b268`, the short sha of v0.28.3's commit. **TO-CONFIRM:** the v0.28.3 tag must land on `50f5b268`. `apps/bab/console/releases/50f5b268/` does not exist yet, so the ship is new. |
| +- Console ship version `CV`: `50f5b268`, the short sha of v0.28.3's commit. platform-1e says the v0.28.3 tag lands on `50f5b268`; **TO-CONFIRM** against the published tag. `apps/bab/console/releases/50f5b268/` does not exist yet, so the ship is new. |
| - Identity key: `control/system/router/releases/v0.28.3.json`, a new create-only key. The v0.28.2 identity stays at `control/system/router/releases/v0.28.2.json` (1076 bytes, `2d22f05f`) exactly as it is: permanent, unused, never deleted or rewritten. |
| - Floor: `{"min": 1, "min_release": "v0.28.3"}` (`floor.json`, sha256 `c7063389c0bd78a7cd7b400cf6a548cf527320fd562dd6c26ded1a0ecc0f303f`). Expected `floor_sha256` `07d2b63e711af4d97fad48713096447ce3c81ff92db0e956a98543478484aa09`, the sha256 of the compact form `{"min":1,"min_release":"v0.28.3"}` (the same rule gives v0.28.2's `3a361ab8…`). `sign-policy`'s own output is the value of record. |
| - Policy and identity files: new bytes, new paths. On the signer and on both boxes: `/root/claim-trial/policy.v0.28.3.json` and `/root/claim-trial/identity.v0.28.3.json`. The v0.28.2 files (`policy.json` `dfac87e6`, `identity.json` `2d22f05f`) stay staged on leo and sophie, unused. |
| - Signer: write grant on exactly `control/system/router/releases/v0.28.3.json`, no prefix; CLI carlos v0.28.3 `linux-arm64` (TO-CONFIRM above); jq 1.7.1 `4dd2d8a0…b4a5` (unchanged). |
| - Console rollback version: `7c1beb2d`, promoted with digests on. |
| -**The session, in order, each block with its stop points.** Paul's go is said to cover the merge, the release, the dev roll, and the new session from 5.1's leftovers through step 7. platform-1e confirms with Paul before the signer is created. |
| -1. **Release v0.28.3** (README, "Releasing the platform"): tag `50f5b268`, publish, verify from the public side, then fill in every TO-CONFIRM value above. Stop: the signature does not verify; the tag is not on `50f5b268`; the sums list other debs; the published `carlos-linux-arm64` differs from the local build. |
| +**The session, in order, each block with its stop points.** Paul's go is said to cover the merge, the release, the dev roll, and the new session from 5.1's leftovers through step 7. Paul's go on 2026-10-18 named "publish-identity and the console promote redone for v0.28.3", so 5.0a's promote-only step is approved, with `7c1beb2d` as its rollback (relayed by platform-1e). platform-1e confirms with Paul before the signer is created. |
| +1. **Release v0.28.3** (README, "Releasing the platform"): tag `50f5b268`, publish, verify from the public side, then fill in every TO-CONFIRM value above. Stop: the signature does not verify; the tag is not on `50f5b268`; the sums list other debs; any published sha256 differs from the local build's value recorded above (`carlos-linux-arm64` `6154afb4…def0`, `carlos-linux-amd64` `82a60203…69b2`). |
| 2. **Dev roll, boxes only** (step 1's commands with `--version v0.28.3`, `stable` then `canary`; no console item). Stop: any box not `current` at v0.28.3, `refused` or `rolled-back`; `carlos-instance-control` not restarted (H4). Expected after: each box `carlos v0.28.3`, `.prev` `carlos v0.28.2`. |
| -3. **5.0a, promote-only**: ship and promote the v0.28.3 console to `canary/console`. Digests are already on. Stop: the console's sha256 is not `3660b44c…ec74`; a pointer row `written after digests were turned on`; the header or `readlink` not `50f5b268`. |
| +3. **5.0a, promote-only** (approved: Paul's go of 2026-10-18 names the console promote redone for v0.28.3): ship and promote the v0.28.3 console to `canary/console`. Digests are already on. Stop: the console's sha256 is not `3660b44c…ec74`; a pointer row `written after digests were turned on`; the header or `readlink` not `50f5b268`. |
| 4. **Open the session** (`signing-host.md`, "Create", with the v0.28.3 key and CLI). This puts the release key on a host a second time. Stop: a checksum mismatch; `carlos version` not `carlos v0.28.3`; a key file that is not root `600`. |
| 5. **5.1, resumed** ("5.1 in the second session"): `refresh` only, never `initialize`. Stop: revision not 5, or the listing or a staged file differs. |
| 6. **Step 6**: 6.1 `sign-policy` and `publish-identity` (new `--out` paths), staging under new paths; **6.1a `install-channel --policy` on leo, then sophie**; 6.2 `guard-arm` on leo; 6.3 P9, `install-console`, `guard-arm --console`, `console-config`, the restart, and the wait for both boxes' `floor_guard_ready`. Stop: any refusal, any identity value other than 6.1's expected ones, any line from 6.1a other than the expected ones. |
| -7. **Step 7**: readers first (P3, now with `carlos.prev`); then **`console-report` on sophie, followed IMMEDIATELY by `publish-floor` on the signer** (the console's evidence lasts only until the agent's next status tick, about 5 minutes, #312); then home, leo's key, the `jq -e` check and the console runtime. Stop: a reader below v0.28.3; `jq -e` not `true`; `publish-floor` refused twice. |
| +7. **Step 7**: readers first (P3, now with `carlos.prev`), then the read-only check that dennis's guard is unarmed; then **`console-report` on sophie, followed IMMEDIATELY by `publish-floor` on the signer** (the console's evidence lasts only until the agent's next status tick, about 5 minutes, #312); then home, leo's key, the `jq -e` check and the console runtime. Stop: a reader below v0.28.3; an armed policy on dennis; `jq -e` not `true`; `publish-floor` refused twice. |
| 8. **Close the session**: shred the key, terminate the signer, remove the exchange objects, delete the role, profile and security group, then the CloudTrail check ("Closing the signing session"). Always allowed, and done at any stop. |
| -**TO-CONFIRM before the session** |
| -1. Is v0.28.3 published? Then, from its signed `SHA256SUMS.txt` (signature verified with the README's pinned key): the `carlos-linux-arm64` and `carlos-linux-amd64` sha256 values, and the sha256 of `SHA256SUMS.txt` and `.sig`. Fill them in here, in 6.1's expected identity, and in `claim-trial-inputs/`. |
| -2. The v0.28.3 tag is on `50f5b268`, so `CV` is `50f5b268`. If it is anywhere else, stop and ask: the prebuilt console's source and the ship version would not match. |
| +**TO-CONFIRM before the session.** Items 1 to 3 stay open until platform-1e posts "v0.28.3 on dev" with the published `SHA256SUMS.txt` values and the roll results. |
| +1. Is v0.28.3 published? Then, from its signed `SHA256SUMS.txt` (signature verified with the README's pinned key): the `carlos-linux-arm64` and `carlos-linux-amd64` sha256 values, and the sha256 of `SHA256SUMS.txt` and `.sig`. Fill them in here, in 6.1's expected identity, and in `claim-trial-inputs/`. Any published sha256 that differs from the local build's value stops the release block. |
| +2. The v0.28.3 tag is on `50f5b268` (platform-1e: it lands there), so `CV` is `50f5b268`. If the published tag is anywhere else, stop and ask: the prebuilt console's source and the ship version would not match. |
| 3. The dev roll: every box `carlos v0.28.3`, `.prev` `carlos v0.28.2`, `current`. |
| -4. Whether the dev-roll go covers 5.0a's console promote. It is the dev roll's console item, held back so it lands after the boxes; if it is not covered, ask. |
| -5. Dennis's `carlos.prev`. After the roll it is v0.28.2, and nothing in this session replaces it (dennis is not armed and is not in the trial). P3's pass says every `.prev` image is on the trial release before step 7. platform-1e rules whether dennis's `.prev` at v0.28.2 passes P3, or whether dennis also runs 6.1a. |
| + |
| +**Answered by platform-1e, 2026-10-18** |
| +- **5.0a's console promote is approved.** Paul's go on 2026-10-18 named "publish-identity and the console promote redone for v0.28.3". The rollback is `7c1beb2d`. |
| +- **Dennis's `carlos.prev` is out of scope.** P3 is about each roster reader's version being at least the floor, not about `.prev`. Dennis is not enrolled and is outside the census scope (region `uk`, pools not `cohort1`; `internal/hostactors/census.go:100` on main `50f5b268`). Never run `install-channel` on dennis: it would destroy its rollback copy for no benefit. Instead, step 7 checks read-only, before the report-and-floor pair, that dennis's guard is unarmed, so the published floor does not bind dennis's recovery. An armed policy on dennis is a STOP. |
| Later, each with its own go and outside this package: 7a.2 (fence-writer credentials), step 8 (leo's offline window), steps 9 and 10. |
| @@ -153,7 +155,7 @@ carlos version |
| Run the box line on sophie and dennis too. Pass: before step 7, every box, `.prev` image, console and operator CLI is on the trial release. |
| -For the v0.28.3 session (from the prev-rehearsal): every box line has two lines, `carlos` and `carlos.prev`. After the v0.28.3 dev roll, `.prev` is v0.28.2. On leo and sophie, step 6.1a's `install-channel --policy` makes it v0.28.3, so before step 7 both their slots read `carlos v0.28.3`. Each box's channel pointer must name v0.28.3, tag v0.28.3, with the same `carlos-linux-arm64` sha256 as the identity: leo follows `stable`, sophie `canary` (`carlos system status`). Dennis's `.prev` stays v0.28.2: platform-1e rules whether that passes (Go package, TO-CONFIRM 5). In the v0.28.3 session P3 runs at the start of step 7, before `console-report`, never between `console-report` and `publish-floor`. |
| +For the v0.28.3 session (from the prev-rehearsal): every box line has two lines, `carlos` and `carlos.prev`. After the v0.28.3 dev roll, `.prev` is v0.28.2. On leo and sophie, step 6.1a's `install-channel --policy` makes it v0.28.3, so before step 7 both their slots read `carlos v0.28.3`. Each box's channel pointer must name v0.28.3, tag v0.28.3, with the same `carlos-linux-arm64` sha256 as the identity: leo follows `stable`, sophie `canary` (`carlos system status`). Dennis's `.prev` stays v0.28.2, and that passes. platform-1e's ruling (2026-10-18): P3 is about each roster reader's version being at least the floor, not about `.prev`. Dennis is not enrolled and is outside the census scope (region `uk`, pools not `cohort1`: the `required` test at `internal/hostactors/census.go:100` on main `50f5b268`), so its `.prev` is not checked. Do NOT run `install-channel` on dennis: it would destroy its rollback copy for no benefit. What step 7 checks on dennis instead is that its guard is unarmed (7.1). In the v0.28.3 session P3 runs at the start of step 7, before `console-report`, never between `console-report` and `publish-floor`. |
| 2026-10-17, re-run today: leo v0.27.3 (`.prev` v0.27.2), sophie v0.27.3 (`.prev` v0.27.2), dennis v0.27.3 (no `.prev`), console `e15ad6be` (v0.27.3), local CLI v0.27.2. `system status`: leo and dennis on `stable`, sophie on `canary`, all `current`. v0.27.3 is still the latest release, and it contains neither 26065378 (Plan 14 Parts 2 and 3 and the activation tools) nor e8e961dd (the empty-app writer fix). Step 1 fixes that. Every one of these builds already contains Plan 13, so the home designation order is safe once they are all on the trial release. |
| @@ -531,7 +533,7 @@ Any other answer is a stop. The `invite-box` dry run in 5.1 then checks the same |
| ### 5.0a The release-stamped dev console for v0.28.3 (promote-only) |
| -Runs after v0.28.3 is published and on dev's boxes (Go package, blocks 1 and 2), and before the second signing session opens. It is the v0.28.3 dev roll's console item, held back so it lands after the boxes; Paul's go is the one for the dev roll (Go package, TO-CONFIRM 4). It changes nothing claim-related. |
| +Runs after v0.28.3 is published and on dev's boxes (Go package, blocks 1 and 2), and before the second signing session opens. It is the v0.28.3 dev roll's console item, held back so it lands after the boxes. Approved: Paul's go on 2026-10-18 named "publish-identity and the console promote redone for v0.28.3" (relayed by platform-1e), with `7c1beb2d` as the rollback. It changes nothing claim-related. |
| Digests have been on for `bab` since the first run (`pointer digests: on for bab since 2026-10-18T10:11:25Z`; the marker `releases/bab/pointer-digests`, 219 bytes, was read again on 2026-10-18 at 14:30Z). So the first run's item 3 (digests on) is not repeated, and its "Before 4" rollback no longer applies. What is left is item 4: ship and promote the prebuilt v0.28.3 console to `canary/console`. |
| @@ -836,7 +838,7 @@ Order of work for the second session (v0.28.3), each block with its stop points: |
| 1. **Open the session.** Only once v0.28.3 is published and verified, every dev box reads `carlos v0.28.3` (`.prev` `carlos v0.28.2`) and `current`, and 5.0a for v0.28.3 has passed. platform-1e confirms with Paul, then: create the signer host and its role policy (`signing-host.md`, "Create", with write on exactly `control/system/router/releases/v0.28.3.json`), install the verified tools (carlos v0.28.3 `linux-arm64`, sha256 TO-CONFIRM from the signed sums; jq 1.7.1 `4dd2d8a0...`), then fetch the key into tmpfs (`signing-host.md`, "Getting the key there"). Record the session's start time before the key fetch, and choose a new exchange `<run-id>`. Stop points: a checksum mismatch, `carlos version` not `carlos v0.28.3`, `claims help` not as quoted below, or a key file that is not root `600`. |
| 2. **5.1, resumed.** "5.1 in the second session". Stop points: revision not 5, the listing not as recorded, or a staged file missing or with another sha256. |
| 3. **Step 6.** In order: 6.1 `sign-policy` and `publish-identity` on the signer with new `--out` paths, then staging under new paths on leo and sophie; 6.1a `install-channel --policy` on leo, then on sophie; 6.2 `guard-arm` on leo; 6.3 the P9 re-run from DOCS-T1, then `install-console`, `guard-arm --console`, `console-config` and the restart on sophie, then the wait until both boxes' reports carry `floor_guard_ready`. `console-report` is not in step 6 any more: it opens step 7's report-and-floor pair. Stop points: any refusal; an identity value other than step 6.1's expected values (a wrong published identity cannot be replaced); any 6.1a output other than its expected lines; any P9 `SET` line or console-mail role policy; `console.service` not `active`. |
| -4. **Step 7** (`home_region` becomes write-once). Readers re-checked first (P3, with `carlos.prev`). Then `console-report` on sophie, **followed immediately by `publish-floor` on the signer**, then home, leo's key and the console runtime. Stop points: any reader below v0.28.3; `publish-floor` refused after one fresh `console-report`; the `jq -e` roster check not `true`; a refused report that a fresh box report does not clear. |
| +4. **Step 7** (`home_region` becomes write-once). Readers re-checked first (P3, with `carlos.prev`), then the read-only check that dennis's guard is unarmed. Then `console-report` on sophie, **followed immediately by `publish-floor` on the signer**, then home, leo's key and the console runtime. Stop points: any reader below v0.28.3; an armed policy on dennis; `publish-floor` refused after one fresh `console-report`; the `jq -e` roster check not `true`; a refused report that a fresh box report does not clear. |
| 5. **Close the session.** No go needed; always allowed, and done at any stop. Shred the key, terminate the signer, remove the exchange objects, delete its role, profile and security group, then the CloudTrail check ("Closing the signing session", after step 7). Anything unexpected in CloudTrail is reported on #250 before any further step. |
| **Hard ordering: `console-report`, then `publish-floor`, with nothing between them.** `console-report` puts the console's process entry into sophie's box report, `status/boxes/sophie-knitting.json`. The agent writes that report whole at its next status tick (every 5 minutes plus jitter), and the entry is gone (#312; the prev-rehearsal saw 0 console process entries in the next report). `publish-floor` needs that entry. So have the `publish-floor` command ready to send before `console-report` runs, and send it the moment `console-report` succeeds: no P3, no `box_inspect`, no review pause, no other command in between. If `publish-floor` is refused because the entry has gone, run `box_inspect "$SOPHIE"`, then `console-report` again on sophie, then `publish-floor` again at once. |
| @@ -1297,6 +1299,22 @@ That reviewed way is `install-channel --policy` (main `50f5b268`, step 6.1a). It |
| Paul's go: once for step 7. `home_region` becomes write-once as soon as claims are on. In the second session the go must be in hand before 7.2 starts, because `publish-floor` cannot wait for one. |
| 1. **Readers, first.** Re-run P3, with the `carlos.prev` lines. Dennis is not in the trial, but its agent reads the roster, so it counts. Every reader must be on the trial release (v0.28.3) before the home designation is published, and leo's and sophie's `carlos.prev` must read `carlos v0.28.3` (6.1a). Do this before 7.2: nothing may run between `console-report` and `publish-floor`. |
| + |
| + Then, as the last check before 7.2, confirm from DOCS-T1 that dennis's guard is unarmed, so the floor about to be published does not bind dennis's recovery (platform-1e's ruling, 2026-10-18). Dennis is not enrolled and is not in the census scope, and `install-channel` is never run on it. The check runs here, and not between `console-report` and `publish-floor`, because nothing may run between those two. It is read-only: |
| + |
| + ```bash |
| + $TMPDIR/cohort1/ssm.sh eu-west-2 i-009d593f451cfd562 'p=/opt/carlos/system/guard/policy.json; if [ -e $p ]; then echo "present $p $(grep -oE "\"mode\" *: *\"[^\"]*\"" $p | head -1)"; else echo "absent $p"; fi; [ -e /etc/carlos/host-actor.json ] && echo "present /etc/carlos/host-actor.json" || echo "absent /etc/carlos/host-actor.json"; /opt/carlos/carlos version' |
| + ``` |
| + |
| + Pass, exactly (the version line reads `carlos v0.28.3` after the roll): |
| + |
| + ``` |
| + Success absent /opt/carlos/system/guard/policy.json |
| + absent /etc/carlos/host-actor.json |
| + carlos v0.28.3 |
| + ``` |
| + |
| + Run read-only on 2026-10-18 at about 14:45Z, before the roll: `Success`, both `absent`, `carlos v0.28.2`. A `present /opt/carlos/system/guard/policy.json` line is a STOP whatever its mode, and so is status `Failed` or any other output: do not start 7.2, report to platform-1e, and close the session if they say so. |
| 2. **Report and floor, back to back. HARD ORDERING: `console-report` is followed IMMEDIATELY by `publish-floor`.** The console's evidence in sophie's box report lasts only until the agent's next status tick, about 5 minutes (#312). Before starting, check that both boxes' reports carry `floor_guard_ready` (6.3's check), and have the `publish-floor` command ready to send. For the widest window, start just after sophie's report's `generated_at` moves. |
| On the trusted host, stage sophie's current roster and revision (`box_inspect "$SOPHIE"`). Then on sophie: |
| @@ -2222,4 +2240,4 @@ For platform-1e: |
| 6. Answered 2026-10-18: platform-1e builds the armed policy signing phase and the published system identity with the protected console install, in v0.28.2 (blocker 5). Built on branch `claim-step6-artifacts` (census ruled), on main 7c1beb2d, published (v0.28.2, tag on 7c1beb2d): `sign-policy`, `publish-identity` and `install-console`. Step 6 waits for it, and for 5.0a; step 5.0 did not. |
| 7. Still open in `docs/superpowers/notes/claim-trial-inputs/README.md` for the second session: the v0.28.3 release values (TO-CONFIRM until it is published) and the second signer's IDs. The console enrollment token was generated in the first session and is in the roster. Namespace `platform`, sophie's pool `console`, console ID `dev-console` and operator `paul@keymail.dev` are confirmed. |
| 5. The console's mutation classifier lets it delete under `control/boxes/` and `control/box-volumes/`, which the new box-records bucket policy refuses: amadan carlos/platform#302. |
| -8. For platform-1e: does dennis's `carlos.prev` at v0.28.2 pass P3 before step 7, or does dennis also run step 6.1a? (Go package, TO-CONFIRM 5.) |
| +8. Answered 2026-10-18 by platform-1e: dennis's `carlos.prev` at v0.28.2 passes P3 (P3 is about reader versions against the floor; dennis is not enrolled and is outside the census scope). Dennis never runs 6.1a. Step 7.1 checks read-only that its guard is unarmed. |