amadan
docs: cohort-1 runbook: third session: 6.2 PASS, 6.3 STOP at the console restart (guard dir 700 under umask 077), closed
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+26
−1
docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md+26 −1
CI passed — run details
CI log
=== gate ===
cd launchctx && go vet ./... && go test ./... -count=1
ok amadan.net/carlos/platform.git/launchctx 0.011s
? amadan.net/carlos/platform.git/launchctx/controlname [no test files]
? amadan.net/carlos/platform.git/launchctx/wireid [no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok github.com/carlosframework/platform 320.211s
? github.com/carlosframework/platform/cmd/changelog [no test files]
ok github.com/carlosframework/platform/cmd/console 3.029s
ok github.com/carlosframework/platform/cmd/moveprobe 92.169s
ok github.com/carlosframework/platform/cmd/zddprobe 0.703s
ok github.com/carlosframework/platform/internal/activator 251.338s
ok github.com/carlosframework/platform/internal/agentsock 0.019s
ok github.com/carlosframework/platform/internal/alerting 0.003s
ok github.com/carlosframework/platform/internal/analytics 0.020s
ok github.com/carlosframework/platform/internal/appconfig 2.469s
ok github.com/carlosframework/platform/internal/apperr 0.073s
ok github.com/carlosframework/platform/internal/applog 0.133s
ok github.com/carlosframework/platform/internal/awsinv 0.003s
ok github.com/carlosframework/platform/internal/boxchoice 0.006s
ok github.com/carlosframework/platform/internal/boxid 0.673s
? github.com/carlosframework/platform/internal/boxid/boxidtest [no test files]
? github.com/carlosframework/platform/internal/boxid/internal/signtest [no test files]
ok github.com/carlosframework/platform/internal/boxvolumes 0.008s
ok github.com/carlosframework/platform/internal/caps 0.012s
ok github.com/carlosframework/platform/internal/certwarm 0.002s
ok github.com/carlosframework/platform/internal/cgroup 0.696s
ok github.com/carlosframework/platform/internal/changelog 0.305s
ok github.com/carlosframework/platform/internal/claimactivation 0.025s
ok github.com/carlosframework/platform/internal/clamd 0.054s
? github.com/carlosframework/platform/internal/cliflag [no test files]
ok github.com/carlosframework/platform/internal/console 409.518s
? github.com/carlosframework/platform/internal/controlname [no test files]
? github.com/carlosframework/platform/internal/controlsock [no test files]
ok github.com/carlosframework/platform/internal/dbdoor 5.961s
ok github.com/carlosframework/platform/internal/dbdoor/dbdoortest 0.009s
ok github.com/carlosframework/platform/internal/dbverify 0.004s
ok github.com/carlosframework/platform/internal/dnsrec 0.002s
ok github.com/carlosframework/platform/internal/docsite 0.005s
ok github.com/carlosframework/platform/internal/domains 2.420s
ok github.com/carlosframework/platform/internal/doorkey 0.006s
ok github.com/carlosframework/platform/internal/economics 0.003s
ok github.com/carlosframework/platform/internal/edge 44.970s
? github.com/carlosframework/platform/internal/edgeproof [no test files]
ok github.com/carlosframework/platform/internal/edgesfile 0.008s
ok github.com/carlosframework/platform/internal/fleetapi 0.134s
ok github.com/carlosframework/platform/internal/gate 1.655s
ok github.com/carlosframework/platform/internal/genselect 0.014s
ok github.com/carlosframework/platform/internal/geo 0.019s
ok github.com/carlosframework/platform/internal/geoip 0.029s
ok github.com/carlosframework/platform/internal/historyreadback 0.156s
ok github.com/carlosframework/platform/internal/host 177.800s
ok github.com/carlosframework/platform/internal/hostactors 0.568s
ok github.com/carlosframework/platform/internal/hostbox 2.649s
ok github.com/carlosframework/platform/internal/hostclaim 0.552s
ok github.com/carlosframework/platform/internal/hostevidence 0.012s
ok github.com/carlosframework/platform/internal/hostexec 4.781s
ok github.com/carlosframework/platform/internal/hostfence 0.031s
ok github.com/carlosframework/platform/internal/hostfiles 10.387s
ok github.com/carlosframework/platform/internal/hostfloor 0.012s
ok github.com/carlosframework/platform/internal/hostguard 1.062s
ok github.com/carlosframework/platform/internal/hostops 1.643s
? github.com/carlosframework/platform/internal/hostops/fencerelease [no test files]
ok github.com/carlosframework/platform/internal/hostops/internal/fencerelease 0.012s
ok github.com/carlosframework/platform/internal/hostquarantine 0.012s
ok github.com/carlosframework/platform/internal/hostrelocate 0.461s
ok github.com/carlosframework/platform/internal/hostresolve 0.168s
ok github.com/carlosframework/platform/internal/hostwrite 0.012s
ok github.com/carlosframework/platform/internal/infraview 0.013s
ok github.com/carlosframework/platform/internal/instancectl 5.224s
ok github.com/carlosframework/platform/internal/instanceexec 2.745s
ok github.com/carlosframework/platform/internal/instancefs 0.017s
ok github.com/carlosframework/platform/internal/instancekey 0.013s
ok github.com/carlosframework/platform/internal/instanceupdates 0.019s
ok github.com/carlosframework/platform/internal/layout 1.554s
ok github.com/carlosframework/platform/internal/lbhealth 0.002s
ok github.com/carlosframework/platform/internal/lease 9.806s
ok github.com/carlosframework/platform/internal/lease/leasetest 0.005s
ok github.com/carlosframework/platform/internal/ledger 0.011s
ok github.com/carlosframework/platform/internal/mail 0.165s
ok github.com/carlosframework/platform/internal/maintenance 0.089s
ok github.com/carlosframework/platform/internal/maintenanceexec 5.472s
ok github.com/carlosframework/platform/internal/maintenanceguard 0.078s
ok github.com/carlosframework/platform/internal/metrics 0.005s
ok github.com/carlosframework/platform/internal/moves 20.941s
ok github.com/carlosframework/platform/internal/moves/archive 0.820s
ok github.com/carlosframework/platform/internal/objstore 0.184s
ok github.com/carlosframework/platform/internal/ops 0.172s
ok github.com/carlosframework/platform/internal/park 0.199s
ok github.com/carlosframework/platform/internal/privatefile 0.003s
ok github.com/carlosframework/platform/internal/provision 18.185s
ok github.com/carlosframework/platform/internal/publicrelease 0.006s
? github.com/carlosframework/platform/internal/regionname [no test files]
ok github.com/carlosframework/platform/internal/registry 5.406s
ok github.com/carlosframework/platform/internal/relay 7.227s
ok github.com/carlosframework/platform/internal/release 21.620s
ok github.com/carlosframework/platform/internal/rollout 3.659s
ok github.com/carlosframework/platform/internal/rolloutwords 0.003s
ok github.com/carlosframework/platform/internal/rootaws 0.006s
ok github.com/carlosframework/platform/internal/rootparticipation 0.057s
ok github.com/carlosframework/platform/internal/rootstate 0.026s
ok github.com/carlosframework/platform/internal/runs 0.571s
ok github.com/carlosframework/platform/internal/s3compat 0.005s
ok github.com/carlosframework/platform/internal/safefile 0.004s
ok github.com/carlosframework/platform/internal/schedule 2.509s
ok github.com/carlosframework/platform/internal/seeds 0.011s
ok github.com/carlosframework/platform/internal/sim/hostlife 8.820s
ok github.com/carlosframework/platform/internal/sim/litestreamfacts 3.886s
ok github.com/carlosframework/platform/internal/status 0.039s
ok github.com/carlosframework/platform/internal/steering 0.005s
ok github.com/carlosframework/platform/internal/stopevidence 0.252s
ok github.com/carlosframework/platform/internal/svcrole 0.002s
ok github.com/carlosframework/platform/internal/telemetry 0.005s
ok github.com/carlosframework/platform/internal/termfence 0.005s
ok github.com/carlosframework/platform/internal/tunnelclient 0.004s
ok github.com/carlosframework/platform/internal/unixdial 0.002s
ok github.com/carlosframework/platform/internal/updatewords 0.004s
ok github.com/carlosframework/platform/internal/usage 0.004s
ok github.com/carlosframework/platform/internal/version 0.002s
ok github.com/carlosframework/platform/internal/vet 1.542s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
linux/arm64 carlos binary: 48824482 bytes (ceiling 52000000)
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
minio: cached, digest verified
mc: cached, digest verified
minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
buckets and scoped user ready
=== RUN TestDeliveredContractMinio
=== RUN TestDeliveredContractMinio/put
=== RUN TestDeliveredContractMinio/get_round-trips_the_body
=== RUN TestDeliveredContractMinio/list_shows_the_key
=== RUN TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN TestDeliveredContractMinio/delete_removes_it
=== RUN TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
--- PASS: TestDeliveredContractMinio/put (0.00s)
--- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
--- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
--- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
--- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok github.com/carlosframework/platform/internal/objstore 0.025s
=== RUN TestT4StorageProbeMinio
2026/10/19 15:34:29 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18DFF831D375F234, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.01s)
PASS
ok github.com/carlosframework/platform/internal/host 0.022s
minio contract: PASS
diff --git a/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md b/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md| index 0377d2f59..258276826 100644 |
| --- a/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md |
| +++ b/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md |
| @@ -37,7 +37,7 @@ Final, 2026-10-19. Every value below was read or verified read-only on DOCS-T1 b |
| 3. **5.0a, promote-only** (approved). **DONE 2026-10-19 07:58Z, PASS**: `x-carlos-version: f3bf1214`, digests `yes`, P9 PASS, no rollback (record under 5.0a). Ship and promote `f3bf1214` to `canary/console` with the v0.28.4 amd64 CLI, then re-run P9. Stop: the console's sha256 is not `8d49199f…5e9b`; a pointer row `written after digests were turned on`; the header or `readlink` not `f3bf1214`; any P9 `SET` line or console-mail role policy. Rollback: promote `7c1beb2d`. |
| 4. **Open the session** (`signing-host.md`, "Create"). platform-1e confirms with Paul first. This puts the release key on a host a second time. Stop: a checksum mismatch; `carlos version` not `carlos v0.28.4`; `claims help` not as quoted; a key file that is not root `600`. **DONE 2026-10-19 09:12Z to 09:14Z, PASS**: signer `i-006e3c79dfdf5d814`, SG `sg-0a0f98545441cf295`, run-id `cohort1-20261019T091304Z`, session start `2026-10-19T09:14:14Z` (record under "5.1 in the second session"). |
| 5. **5.1, resumed** ("5.1 in the second session"): the box re-check, then `refresh` only, never `initialize`. Stop: revision not 5, the listing not as recorded, or a staged file missing or changed. **DONE 2026-10-19 09:15Z, PASS**: revision 5, listing as recorded, every staged file unchanged. |
| -6. **Step 6**: 6.1 `sign-policy` and `publish-identity` (new `--out` paths) and staging under new paths; 6.1a the `-h` check, then `install-channel --policy --identity` on leo, then sophie; 6.2 `guard-arm` on leo; 6.3 P9 (third run), `install-console`, `guard-arm --console`, `console-config`, the restart, and the wait for both boxes' `floor_guard_ready`. Stop: any refusal (6.1a lists its refusals, the `--identity` ones included); an identity value other than the expected ones above; any 6.1a output other than its expected lines; a P9 `SET` line or console-mail role policy; `console.service` not `active`. **2026-10-19: 6.1 and 6.1a PASS; 6.2 STOP; the session is closed** (record under "The second session's step 6"). `guard-arm` on leo refused with `hostfloor: authenticated floor required` because `/opt/carlos` is owned by `carlos:carlos` (host-init's `chown -R carlos:carlos /data /opt/carlos`), and `OpenProtected` needs every parent of `/opt/carlos/carlos` root-owned. Sophie has the same ownership. Held for a ruling on #250. |
| +6. **Step 6**: 6.1 `sign-policy` and `publish-identity` (new `--out` paths) and staging under new paths; 6.1a the `-h` check, then `install-channel --policy --identity` on leo, then sophie; 6.2 `guard-arm` on leo; 6.3 P9 (third run), `install-console`, `guard-arm --console`, `console-config`, the restart, and the wait for both boxes' `floor_guard_ready`. Stop: any refusal (6.1a lists its refusals, the `--identity` ones included); an identity value other than the expected ones above; any 6.1a output other than its expected lines; a P9 `SET` line or console-mail role policy; `console.service` not `active`. **2026-10-19: 6.1 and 6.1a PASS; 6.2 STOP; the session is closed** (record under "The second session's step 6"). `guard-arm` on leo refused with `hostfloor: authenticated floor required` because `/opt/carlos` is owned by `carlos:carlos` (host-init's `chown -R carlos:carlos /data /opt/carlos`), and `OpenProtected` needs every parent of `/opt/carlos/carlos` root-owned. Sophie has the same ownership. Held for a ruling on #250. **Third session, 2026-10-19 15:18Z to 15:25Z** (after the ownership fix): 6.2 PASS (leo armed, `floor_guard_ready` reported); 6.3 P9, `install-console`, `guard-arm --console` and `console-config` PASS; **STOP at the console restart**: `203/EXEC` `Permission denied` on `/opt/carlos/system/guard/carlos`, because the 6.3 block's `umask 077` made sophie's guard directory `700` and the console runs as `carlos`. The dev console is down (502) and held; sophie's edge fails the same way on its next restart. Session closed, CloudTrail clean (record under "The third session"). |
| 7. **Step 7**: readers first (P3), then the dennis guard check (7.1), then **`console-report` on sophie, followed IMMEDIATELY by `publish-floor` on the signer** (the console's evidence lasts only until the agent's next status tick, about 5 minutes, #312), then home, leo's key, the `jq -e` check and the console runtime. Stop: a reader below v0.28.4; an armed policy on dennis; `publish-floor` refused after one fresh `console-report`; `jq -e` not `true`. |
| 8. **Close the session**, always allowed and done at any stop: shred the key on the signer; terminate the instance; remove the exchange objects under `claim-signer/<run-id>/` by exact key; delete the role, instance profile, inline and managed policy attachments and security group. Then the CloudTrail check from DOCS-T1 ("Closing the signing session"): every `GetParameter` on `/carlos/release-key` since the session's start comes from `assumed-role/carlos-claim-signer/<instance id>`, one per key fetch; no instance tagged `purpose=claim-signer` pending or running; `NoSuchEntity` for the role. Anything else goes to #250 before any further step. |
| @@ -1365,6 +1365,31 @@ Block 4, opening, 15:18Z to 15:20Z: PASS. |
| Block 5, `refresh` only, 15:21Z: PASS. `/root/claim-trial` on the signer (root `700`) holds `release.pub`, `floor.json`, `helpers.sh` (`208ee7d9`, the same bytes as the second session's), `SHA256SUMS.txt` and `.sig`, each root `600` and `OK`. `REV=5`, etag `f3717d8d…`; region `ie` (namespace `platform`, pools `cohort1` and `console`), `request_limit_ns` 120000000000; `leo-climbing` pool `cohort1`, `i-046c7fe43620944bc`, `active`; `sophie-knitting` pool `console`, `i-05498eada6f0afd23`, `active`; `dev-console` with compute `sophie-knitting`, namespaces `platform`; `holds` and `activations` empty (enrollments redacted). `inspect.json` `c9143bdf` and `roster.json` `6fc74d75`, the same bytes as both earlier sessions'. |
| +**Step 6 from 6.2: 6.2 PASS; 6.3 STOP at the console restart. The session is closed. Step 7 did not start.** |
| + |
| +6.2, arm leo, 15:21:23Z: PASS. The block exactly as quoted (no `umask` line). SSM `Success`, no output. Afterwards: `/etc/carlos/host-actor.json` (root `644`, 106 bytes); `/opt/carlos/system/guard` root `755` with `carlos` (`736826e4`, `755`), `identities/` (`755`, holding `v0.28.4.json` `644`) and `policy.json` (`644`, 507 bytes, `"mode":"armed"`, `cmp`-equal to `policy.v0.28.4.json`); `/etc/systemd/system/carlos-edge.service.d/90-host-floor.conf` (`Requires=` and `After=carlos-system-recover.service`, `ExecStart=/opt/carlos/system/guard/carlos system guard-exec edge`). `guard-arm` restarted nothing: leo's edge and instance-control stayed `active` since 07:51:53Z. `CARLOS_HOST_CLAIM` still absent. Leo's report at 15:26:05Z: `v0.28.4`, `736826e4`, `floor_guard_ready` `True`, `floor_sha256` `1a6a7e50`. The agent reads the guard from disk on each tick (`claimReport`, `hostfloor.Disk.Running` at `f3bf1214`), so no edge restart was needed for it. |
| + |
| +6.3, in order: |
| +1. P9 on sophie, 15:22:06Z: PASS. `Success`, `checked: the running console (pid 613198), console.service Environment=, and 5 files:` the same five files as before, no `SET` and no `missing:` line, `console mail: OFF (none of the 7 names is set)`. Sophie's role policies: `carlos-dev-host-buckets`, `carlos-dev-host-metrics`, `deny-release-key-reads`. After a `git fetch`, the dev root grep at `platform-infrastructure` main `a0b3f5a` printed nothing. |
| +2. `box_inspect "$SOPHIE"`: `staged` twice; `rev` `5`, `roster.json` `6fc74d75`, etag `f3717d8d…`. The source `/opt/carlos/versions/f3bf1214/console` is a regular file, root `755`, one link, 47186082 bytes, `8d49199f`. |
| +3. `install-console`, 15:22:44Z: PASS. The dry run and the apply both printed `release_tag` `v0.28.4`, `sha256` `8d49199f…5e9b`, `path` `/opt/carlos/system/console/console`, `previous` `…/console.prev`, `mode` `0755`, `already_installed` false. Both files root `755`, 47186082 bytes, `8d49199f`; the directory root `755`. `console.service` untouched and `active`. |
| +4. `guard-arm --console`, 15:22:57Z: SSM `Success`, no output. Afterwards: `host-actor.json` (109 bytes), `guard/policy.json` `cmp`-equal to the staged policy, `guard/console-ready.json`, the edge drop-in `90-host-floor.conf` (as on leo) and `console.service.d/90-host-floor.conf` (`ExecStart=/opt/carlos/system/guard/carlos system guard-exec console /opt/carlos/system/console/console serve`). Edge, instance-control and the console `active`. |
| +5. `console-config`, 15:23:13Z: the dry run and the apply both succeeded at revision 5 (`CID` `dev-console`). It wrote `/etc/carlos/claim-console.env` (root `600`, 72 bytes, names `CARLOS_CONSOLE_ID`, `CONSOLE_HOME_REGION`, `CARLOS_HOST_CLAIM`) and `console.service.d/91-claim-runtime.conf` (`EnvironmentFile=/etc/carlos/claim-console.env`). |
| +6. `systemctl restart console.service`: **STOP.** `is-active` printed `activating` and the block exited 3. The journal shows a restart loop, every 2 seconds, from 15:23:15Z: `console.service: Failed to execute /opt/carlos/system/guard/carlos: Permission denied`, `status=203/EXEC` (53 restarts by 15:25:12Z). The dev console answers 502 on `/` and `/healthz` (the 502 still carries `x-carlos-version: f3bf1214`). |
| + |
| +Cause, read-only on the boxes and from `f3bf1214`: on sophie `/opt/carlos/system/guard` and `guard/identities` are `root:root 700`, and `console.service` runs `User=carlos`, so the carlos user cannot reach `guard/carlos` (`runuser -u carlos -- test -x` fails). On leo both are `755` and the same test passes. `guard-arm` creates them with `os.MkdirAll(dir, 0755)` (`internal/host/guardarm.go:115` and `:183`), which the umask reduces, and the 6.3 block starts with `umask 077`; the 6.2 block has none. The files inside (`carlos` `755`, `policy.json` and the identity `644`) are fine. |
| + |
| +**Hazard left in place: sophie's edge.** Sophie's `carlos-edge.service.d/90-host-floor.conf` also runs `/opt/carlos/system/guard/carlos` as `User=carlos`. The edge is still serving only because it has not restarted since 07:50:46Z. Its next restart (an update on `canary`, a crash, a reboot) fails the same way and takes sophie's edge down, wakecheck and the dev console's route with it. Leo is not affected. |
| + |
| +Service checks at 15:25:47Z: wakecheck through DNS 200 (`host=ip-172-31-14-16`, sophie); claimtrial via `--resolve` to leo 200 (`host=ip-172-31-19-180`); the dev console 502 on `/` and `/healthz`, so the "running from the protected path" check could not pass. No AccessDenied line in either box's journal since 15:15Z (0 on each, Cost Explorer included). |
| + |
| +Closing the signing session, 15:23Z to 15:25Z, in full: |
| +1. The key was shredded on the signer and `/run/claim-signer` removed (`shredded`, `dir gone`), 15:23:44Z. |
| +2. `i-0d2236c4b1924ee58` (root volume `DeleteOnTermination` true) was `terminated` at 15:24:24Z. The 7 exchange objects under `claim-signer/cohort1-20261019T151914Z/` were removed by exact key, after the listing was checked to equal the keys recorded at upload; nothing remains under `claim-signer/`. Then the role was taken out of the profile, the profile deleted, the inline policy deleted, the managed policy detached, the role deleted, and `sg-0f97ee97ab8545ced` deleted. |
| +3. CloudTrail since `2026-10-19T15:20:21Z`: one `GetParameter` on `/carlos/release-key`, at 15:20:23Z from `arn:aws:sts::640012953448:assumed-role/carlos-claim-signer/i-0d2236c4b1924ee58`, the session's one key fetch. No instance tagged `purpose=claim-signer`; `NoSuchEntity` for the role and the profile; no `carlos-claim-signer` security group. |
| + |
| +Left as they are ("Stop and hold"): leo armed (guard, `host-actor.json`, edge drop-in), reporting `floor_guard_ready`; sophie armed with `--console`, its protected console and `.prev`, `console-ready.json`, both `90-host-floor.conf` drop-ins, `claim-console.env` and `91-claim-runtime.conf`, and `console.service` in its restart loop; the guard directory modes; the roster at revision 5; no floor published (`control/moves-protocol.json` 404); the published v0.28.4 identity; every staged file. No host.env or flag changed beyond what `console-config` wrote. Getting the console back, and making sophie's guard directories reachable by the carlos user (and fixing the 6.3 block's `umask`), need a ruling on #250 and Paul's go. Step 7 then needs a fourth signing session; 6.2, `install-console` and `guard-arm --console` are done and one-way. |
| + |
| ### The second session's step 6 (v0.28.4, 2026-10-19) |
| **2026-10-19: 6.1 PASS; 6.1a PASS on leo and sophie; 6.2 STOP. The session is closed.** Run by the executor for the controller, on Paul's go for step 6 (install-channel, guard-arm and the guarded console restart included), confirmed directly with the controller. Commands went over SSM from DOCS-T1, as in 5.1. No host.env or flag was changed. P9, `install-console`, `guard-arm --console`, `console-config` and the console restart were not run: the dev console is untouched (`f3bf1214` from 5.0a). |