carlos / platform Public

docs: cohort-1 inputs and runbook take platform-1e's TO-CONFIRM rulings

- Confirmed: namespace platform, sophie's pool console, console ID
  dev-console. Operator stays TO-CONFIRM for Paul, suggested default
  paul@keymail.dev.
- Sophie's protected console path and .prev: BLOCKED on gap 2, no
  hand-made files.
- Gaps 1 and 2 confirmed; platform-1e builds the armed policy signing
  phase and the published system identity with the protected console
  install, shipping in v0.28.2. floor.json min_release is v0.28.2;
  policy and identity templates updated.
- Runbook: step 5 is unblocked once v0.28.1 is on dev (with Paul's
  approval of the package); step 6 waits for v0.28.2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 1 week ago 2f9fce24d58917efa0f37ca41e9050b3284f93f7 parent c29518e

8 files changed, +64 −47

docs/superpowers/notes/claim-trial-inputs/README.md +36 −29
docs/superpowers/notes/claim-trial-inputs/floor.json +1 −1
docs/superpowers/notes/claim-trial-inputs/identity.template.json +8 −5
docs/superpowers/notes/claim-trial-inputs/leo.json +1 −1
docs/superpowers/notes/claim-trial-inputs/policy.template.json +5 −2
docs/superpowers/notes/claim-trial-inputs/signing-host.md +3 −3
docs/superpowers/notes/claim-trial-inputs/sophie.json +1 −1
docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md +9 −5

CI passed — run details

CI log

=== gate ===
cd launchctx && go vet ./... && go test ./... -count=1
ok  	amadan.net/carlos/platform.git/launchctx	0.011s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok  	github.com/carlosframework/platform	314.282s
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	2.863s
ok  	github.com/carlosframework/platform/cmd/moveprobe	93.497s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.704s
ok  	github.com/carlosframework/platform/internal/activator	250.534s
ok  	github.com/carlosframework/platform/internal/agentsock	0.019s
ok  	github.com/carlosframework/platform/internal/alerting	0.003s
ok  	github.com/carlosframework/platform/internal/analytics	0.025s
ok  	github.com/carlosframework/platform/internal/appconfig	2.520s
ok  	github.com/carlosframework/platform/internal/apperr	0.081s
ok  	github.com/carlosframework/platform/internal/applog	0.152s
ok  	github.com/carlosframework/platform/internal/awsinv	0.005s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.004s
ok  	github.com/carlosframework/platform/internal/boxid	0.841s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.009s
ok  	github.com/carlosframework/platform/internal/caps	0.013s
ok  	github.com/carlosframework/platform/internal/certwarm	0.002s
ok  	github.com/carlosframework/platform/internal/cgroup	0.691s
ok  	github.com/carlosframework/platform/internal/changelog	0.310s
ok  	github.com/carlosframework/platform/internal/claimactivation	0.027s
ok  	github.com/carlosframework/platform/internal/clamd	0.058s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
ok  	github.com/carlosframework/platform/internal/console	409.121s
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	5.741s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.010s
ok  	github.com/carlosframework/platform/internal/dbverify	0.008s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.004s
ok  	github.com/carlosframework/platform/internal/docsite	0.006s
ok  	github.com/carlosframework/platform/internal/domains	2.558s
ok  	github.com/carlosframework/platform/internal/doorkey	0.009s
ok  	github.com/carlosframework/platform/internal/economics	0.005s
ok  	github.com/carlosframework/platform/internal/edge	45.311s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.008s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.140s
ok  	github.com/carlosframework/platform/internal/gate	1.677s
ok  	github.com/carlosframework/platform/internal/genselect	0.025s
ok  	github.com/carlosframework/platform/internal/geo	0.036s
ok  	github.com/carlosframework/platform/internal/geoip	0.064s
ok  	github.com/carlosframework/platform/internal/historyreadback	0.207s
ok  	github.com/carlosframework/platform/internal/host	183.628s
ok  	github.com/carlosframework/platform/internal/hostactors	0.825s
ok  	github.com/carlosframework/platform/internal/hostbox	2.994s
ok  	github.com/carlosframework/platform/internal/hostclaim	0.637s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.016s
ok  	github.com/carlosframework/platform/internal/hostexec	5.597s
ok  	github.com/carlosframework/platform/internal/hostfence	0.037s
ok  	github.com/carlosframework/platform/internal/hostfiles	10.883s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.016s
ok  	github.com/carlosframework/platform/internal/hostguard	1.038s
ok  	github.com/carlosframework/platform/internal/hostops	1.673s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.016s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.016s
ok  	github.com/carlosframework/platform/internal/hostrelocate	0.515s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.167s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.016s
ok  	github.com/carlosframework/platform/internal/infraview	0.017s
ok  	github.com/carlosframework/platform/internal/instancectl	5.367s
ok  	github.com/carlosframework/platform/internal/instanceexec	2.769s
ok  	github.com/carlosframework/platform/internal/instancefs	0.016s
ok  	github.com/carlosframework/platform/internal/instancekey	0.019s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.023s
ok  	github.com/carlosframework/platform/internal/layout	1.623s
ok  	github.com/carlosframework/platform/internal/lbhealth	0.018s
ok  	github.com/carlosframework/platform/internal/lease	9.837s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.005s
ok  	github.com/carlosframework/platform/internal/ledger	0.010s
ok  	github.com/carlosframework/platform/internal/mail	0.188s
ok  	github.com/carlosframework/platform/internal/maintenance	0.098s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	5.584s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.081s
ok  	github.com/carlosframework/platform/internal/metrics	0.007s
ok  	github.com/carlosframework/platform/internal/moves	21.888s
ok  	github.com/carlosframework/platform/internal/moves/archive	0.879s
ok  	github.com/carlosframework/platform/internal/objstore	0.228s
ok  	github.com/carlosframework/platform/internal/ops	0.194s
ok  	github.com/carlosframework/platform/internal/park	0.199s
ok  	github.com/carlosframework/platform/internal/privatefile	0.004s
ok  	github.com/carlosframework/platform/internal/provision	38.091s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.006s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	6.008s
ok  	github.com/carlosframework/platform/internal/relay	7.249s
ok  	github.com/carlosframework/platform/internal/release	22.511s
ok  	github.com/carlosframework/platform/internal/rollout	4.182s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.003s
ok  	github.com/carlosframework/platform/internal/rootaws	0.007s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.059s
ok  	github.com/carlosframework/platform/internal/rootstate	0.027s
ok  	github.com/carlosframework/platform/internal/runs	0.579s
ok  	github.com/carlosframework/platform/internal/s3compat	0.005s
ok  	github.com/carlosframework/platform/internal/safefile	0.004s
ok  	github.com/carlosframework/platform/internal/schedule	2.658s
ok  	github.com/carlosframework/platform/internal/seeds	0.013s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	10.894s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	3.769s
ok  	github.com/carlosframework/platform/internal/status	0.039s
ok  	github.com/carlosframework/platform/internal/steering	0.005s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.205s
ok  	github.com/carlosframework/platform/internal/svcrole	0.002s
ok  	github.com/carlosframework/platform/internal/telemetry	0.004s
ok  	github.com/carlosframework/platform/internal/termfence	0.004s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.005s
ok  	github.com/carlosframework/platform/internal/unixdial	0.003s
ok  	github.com/carlosframework/platform/internal/updatewords	0.004s
ok  	github.com/carlosframework/platform/internal/usage	0.004s
ok  	github.com/carlosframework/platform/internal/version	0.002s
ok  	github.com/carlosframework/platform/internal/vet	1.611s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
linux/arm64 carlos binary: 48824482 bytes (ceiling 52000000)
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
  minio: cached, digest verified
  mc: cached, digest verified
  minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
  buckets and scoped user ready
=== RUN   TestDeliveredContractMinio
=== RUN   TestDeliveredContractMinio/put
=== RUN   TestDeliveredContractMinio/get_round-trips_the_body
=== RUN   TestDeliveredContractMinio/list_shows_the_key
=== RUN   TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN   TestDeliveredContractMinio/delete_removes_it
=== RUN   TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
    --- PASS: TestDeliveredContractMinio/put (0.00s)
    --- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
    --- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
    --- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
    --- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
    --- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok  	github.com/carlosframework/platform/internal/objstore	0.023s
=== RUN   TestT4StorageProbeMinio
2026/10/18 03:47:43 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18DF830BEF05F150, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.00s)
PASS
ok  	github.com/carlosframework/platform/internal/host	0.020s
minio contract: PASS

diff --git a/docs/superpowers/notes/claim-trial-inputs/README.md b/docs/superpowers/notes/claim-trial-inputs/README.md

index 47c250619..3917b2e84 100644

--- a/docs/superpowers/notes/claim-trial-inputs/README.md

+++ b/docs/superpowers/notes/claim-trial-inputs/README.md

@@ -1,6 +1,8 @@

# Claim trial inputs, dev cohort 1 (draft for review)

-These are the concrete inputs the runbook's steps 5 to 7 say "the controller supplies and Paul approves" (`docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md`). They were drafted on 2026-10-18 from dev values read with read-only calls. Nothing here is signed, and no secret is in any file. Every value that could not be confirmed read-only is marked `TO-CONFIRM`, with where it comes from.

+These are the concrete inputs the runbook's steps 5 to 7 say "the controller supplies and Paul approves" (`docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md`). They were drafted on 2026-10-18 from dev values read with read-only calls, then updated with platform-1e's rulings the same day. Nothing here is signed, and no secret is in any file. A value still open is marked `TO-CONFIRM`; one that waits on a platform fix is marked `BLOCKED`.

+Timing: step 5 (roster and enrollment) needs only v0.28.1 on dev and Paul's approval of the package. Step 6 (arming) and later wait for v0.28.2, which carries the fixes for gaps 1 and 2.

Platform main at drafting: `b1118925` (region HA 2b). The box-record verb is on branch `box-publish-record` (`6040bb1c`), merging for v0.28.1.

@@ -25,15 +27,15 @@ Platform main at drafting: `b1118925` (region HA 2b). The box-record verb is on

-| Pools | `cohort1` (leo), `console` (sophie) | leo: runbook step 4 sets `CARLOS_POOLS=cohort1`. Sophie has no `CARLOS_POOLS`, so it serves the shared `""` pool, but a roster pool must be non-empty; `console` is the tools' fixture name | leo confirmed by ruling; sophie TO-CONFIRM (platform-1e) |

+| Pools | `cohort1` (leo), `console` (sophie) | leo: runbook step 4 sets `CARLOS_POOLS=cohort1`. Sophie: platform-1e ruling 2026-10-18; `console` keeps sophie out of cohort1's required set, and with claims off it does not affect sophie's serving | confirmed |

| Box references and labels | `leo-climbing`, `sophie-knitting` | each box's name in `carlos system status` and its `metricsBoxLabel`; the record key is `control/boxes/<reference>.json` | confirmed |

| Console enrollment | 32 lowercase hex characters | `hostactors` token rule `^[0-9a-f]{32}$`; chosen once at approval and kept | TO-CONFIRM (generated at approval) |

-| Floor | `{"min": 1, "min_release": "v0.28.1"}` | `moves.ProtocolVersion` is `1` on main; v0.28.1 is the first release with the box-record verb | min confirmed; `min_release` TO-CONFIRM until v0.28.1 is published |

+| Floor | `{"min": 1, "min_release": "v0.28.2"}` | `moves.ProtocolVersion` is `1` on main; v0.28.2 is the first release with the gap 1 and 2 fixes, which arming needs | min confirmed; `min_release` v0.28.2 by ruling, final once v0.28.2 is published |

| Release public key | the dev deployment root key, fingerprint `960d03ff` (sha256 of the host.env value) | `CARLOS_RELEASE_PUBKEY` on every dev box | confirmed (public; copy from a box) |

@@ -41,30 +43,35 @@ Platform main at drafting: `b1118925` (region HA 2b). The box-record verb is on

| Artifact | Value | Status |

|---|---|---|

-| Release for boxes and console | v0.28.1, dev only | TO-CONFIRM: not yet published |

-| Router linux-arm64 sha256 (v0.28.1) | from the signed `SHA256SUMS` of the v0.28.1 release | TO-CONFIRM |

-| Console linux-arm64 sha256 (v0.28.1) | from the same `SHA256SUMS` | TO-CONFIRM |

+| Release for step 5 | v0.28.1, dev only (box-record verb) | TO-CONFIRM: being cut |

+| Release for step 6 onwards | v0.28.2 (armed policy signing phase, published system identity, protected console install) | TO-CONFIRM: being built by platform-1e |

+| Router linux-arm64 sha256 (v0.28.2) | from the signed `SHA256SUMS` of the v0.28.2 release | TO-CONFIRM |

+| Console linux-arm64 sha256 (v0.28.2) | from the same `SHA256SUMS` | TO-CONFIRM |

| Router linux-arm64 sha256, v0.28.0 (current, for comparison) | `3ca7c74d5356a3995ecf677d142bc32fafaf790a2cc1bc0b628f3eec1b7ea731`, from the signed dev `control/system/router/stable.json` | confirmed |

-| Console executable on sophie | `/opt/carlos/versions/26065378/console` (root-owned; `/opt/carlos/live/platform.dev.carlosframework.com` is a symlink to it in a carlos-owned directory). There is no `.prev` beside it | TO-CONFIRM: `guard-arm --console` needs a root-owned path and a `.prev` that both match the console artifact in the identity |

-| `policy.json` | an armed `hostfloor.Policy` with the floor bytes and a root-signed `moves-protocol` authorization | TO-CONFIRM, and a gap: see below |

-| `identity.json` | the signed system pointer for v0.28.1, `control/system/router/releases/v0.28.1.json` | TO-CONFIRM, and a gap: see below |

+| Console executable on sophie | today `/opt/carlos/versions/26065378/console` (root-owned; `/opt/carlos/live/platform.dev.carlosframework.com` is a symlink to it in a carlos-owned directory), with no `.prev` beside it | BLOCKED on gap 2: no hand-made files; the protected path and its `.prev` come from v0.28.2's console install and must match the signed identity |

+| `policy.json` | an armed `hostfloor.Policy` with the floor bytes and a root-signed `moves-protocol` authorization | BLOCKED on gap 1 (v0.28.2) |

+| `identity.json` | the signed system pointer for v0.28.2, `control/system/router/releases/v0.28.2.json` | BLOCKED on gap 2 (v0.28.2) |

## Gaps found while drafting

-1. **No tool signs the armed policy offline.** `guard-arm` (step 6) refuses anything but `mode: "armed"` with a floor and a valid authorization: a root envelope over `{schema 1, purpose "moves-protocol", deployment_bucket, key "control/moves-protocol.json", sha256 of the floor bytes}`. On main, that authorization is signed only inside `hostfloor.Publish`, which writes it to the bucket, and `PublishFloor` (step 7) refuses unless every actor already reports `FloorGuardReady` for that floor digest, which needs the armed policy. The only other producer, `joinroot.go`, reads an already published floor. So step 6 needs a reviewed way to sign the policy without publishing: for example, a `claims run` phase that signs and prints it on the trusted host. This is for platform-1e.

-2. **No system identity for any release exists in the dev bucket.** `guard-arm --identity` takes a release-workflow signed pointer with `current.release_tag` and `current.moves_protocol >= 1`, stored at `control/system/router/releases/<tag>.json`. The dev bucket holds only `control/system/router/{canary,stable}.json`, whose payloads carry neither field, and `release.PublishSystemIdentity` has no production caller on main. The v0.28.1 release workflow, or platform-1e, must produce and publish it, including the console component for sophie.

-3. **The console needs a root-owned path and a `.prev`.** See the console row above.

-## TO-CONFIRM list

-1. Namespace `platform` (platform-1e).

-2. Sophie's roster pool `console` (platform-1e).

-3. Operator identity for both boxes (Paul).

-4. Console ID `dev-console` (platform-1e).

-5. Console enrollment token (generated at approval).

-6. Floor `min_release` `v0.28.1` (after the release is published).

-7. v0.28.1 router and console sha256 (release `SHA256SUMS`).

-8. Sophie's protected console path and its `.prev` (platform-1e).

-9. `policy.json`: signed armed policy, and the tool to sign it (gap 1).

-10. `identity.json`: signed v0.28.1 system pointer, and who publishes it (gap 2).

-11. Signing host values in `signing-host.md`: the jq and carlos v0.28.1 sha256 values, the security group ID once created, and the bucket keys the runner needs (confirmed by dry runs).

+platform-1e confirmed gaps 1 and 2 on main on 2026-10-18 and is building the fixes, with Paul's go: (a) a `claims run` phase that signs the armed policy's authorization for a floor on the trusted host without publishing anything, and (b) the release workflow publishing the signed system identity (router and console) at `control/system/router/releases/<tag>.json`, plus the protected console install with its `.prev`. Both ship in v0.28.2, before step 6.

+1. **No tool signs the armed policy offline.** `guard-arm` (step 6) refuses anything but `mode: "armed"` with a floor and a valid authorization: a root envelope over `{schema 1, purpose "moves-protocol", deployment_bucket, key "control/moves-protocol.json", sha256 of the floor bytes}`. On main, that authorization is signed only inside `hostfloor.Publish`, which writes it to the bucket, and `PublishFloor` (step 7) refuses unless every actor already reports `FloorGuardReady` for that floor digest, which needs the armed policy. The only other producer, `joinroot.go`, reads an already published floor. So step 6 needs a reviewed way to sign the policy without publishing: for example, a `claims run` phase that signs and prints it on the trusted host. Fix: (a) above.

+2. **No system identity for any release exists in the dev bucket.** `guard-arm --identity` takes a release-workflow signed pointer with `current.release_tag` and `current.moves_protocol >= 1`, stored at `control/system/router/releases/<tag>.json`. The dev bucket holds only `control/system/router/{canary,stable}.json`, whose payloads carry neither field, and `release.PublishSystemIdentity` has no production caller on main. Fix: (b) above.

+3. **The console needs a root-owned path and a `.prev`.** No hand-made files. Fix: (b) above.

+## Open items

+TO-CONFIRM:

+1. Operator identity for both boxes (Paul; suggested default `paul@keymail.dev`).

+2. Console enrollment token, 32 lowercase hex characters (generated at approval).

+3. v0.28.1 published, for step 5.

+4. v0.28.2 published, and its router and console sha256 from the release `SHA256SUMS`; this also fixes the floor's `min_release`.

+5. Signing host values in `signing-host.md`: the jq and carlos sha256 values, the security group ID once created, and the bucket keys the signer needs (confirmed by dry runs).

+BLOCKED (fixes ship in v0.28.2, built by platform-1e):

+6. `policy.json`: the signed armed policy (gap 1).

+7. `identity.json`: the signed v0.28.2 system identity (gap 2).

+8. Sophie's protected console path and its `.prev` (gap 2).

+Confirmed on 2026-10-18: namespace `platform`, sophie's pool `console`, console ID `dev-console`.

diff --git a/docs/superpowers/notes/claim-trial-inputs/floor.json b/docs/superpowers/notes/claim-trial-inputs/floor.json

index edfa9045c..9afe7531e 100644

--- a/docs/superpowers/notes/claim-trial-inputs/floor.json

+++ b/docs/superpowers/notes/claim-trial-inputs/floor.json

@@ -1 +1 @@

-{"min": 1, "min_release": "v0.28.1"}

+{"min": 1, "min_release": "v0.28.2"}

diff --git a/docs/superpowers/notes/claim-trial-inputs/identity.template.json b/docs/superpowers/notes/claim-trial-inputs/identity.template.json

index f2809441c..59ffd71ba 100644

--- a/docs/superpowers/notes/claim-trial-inputs/identity.template.json

+++ b/docs/superpowers/notes/claim-trial-inputs/identity.template.json

@@ -4,14 +4,17 @@

"component": "router",

"channel": "TO-CONFIRM: stable (leo) / canary (sophie)",

"current": {

- "version": "v0.28.1",

- "release_tag": "v0.28.1",

+ "version": "v0.28.2",

+ "release_tag": "v0.28.2",

"moves_protocol": 1,

"artifacts": {

- "linux-arm64": {"key": "bootstrap/router/v0.28.1/carlos-linux-arm64", "sha256": "TO-CONFIRM: v0.28.1 linux-arm64 router sha256"}

+ "linux-arm64": {

+ "key": "bootstrap/router/v0.28.2/carlos-linux-arm64",

+ "sha256": "TO-CONFIRM: v0.28.2 linux-arm64 router sha256"

+ }

- "source": "release:v0.28.1"

+ "source": "release:v0.28.2"

}

- "note": "TO-CONFIRM: the real file is the release-workflow signed pointer ({payload, sig}) stored at control/system/router/releases/v0.28.1.json; sophie's guard-arm --console also needs the console component's artifact and sha256 in it (see README)"

+ "note": "BLOCKED on gap 2 (fix ships in v0.28.2): the real file is the release-workflow signed pointer ({payload, sig}) that the v0.28.2 release workflow publishes at control/system/router/releases/v0.28.2.json, covering the router and the console"

}

diff --git a/docs/superpowers/notes/claim-trial-inputs/leo.json b/docs/superpowers/notes/claim-trial-inputs/leo.json

index 47127ec2b..4661a6e60 100644

--- a/docs/superpowers/notes/claim-trial-inputs/leo.json

+++ b/docs/superpowers/notes/claim-trial-inputs/leo.json

@@ -6,5 +6,5 @@

"pool": "cohort1",

"aws_region": "eu-west-1",

"instance_id": "i-046c7fe43620944bc",

- "operator": "TO-CONFIRM: the approving operator's identity string"

+ "operator": "TO-CONFIRM (Paul): the approving operator's identity; suggested default paul@keymail.dev"

}

diff --git a/docs/superpowers/notes/claim-trial-inputs/policy.template.json b/docs/superpowers/notes/claim-trial-inputs/policy.template.json

index 4b4ae8f1b..825c7b3e0 100644

--- a/docs/superpowers/notes/claim-trial-inputs/policy.template.json

+++ b/docs/superpowers/notes/claim-trial-inputs/policy.template.json

@@ -2,6 +2,9 @@

"schema": 1,

"deployment_bucket": "carlos-dev-640012953448",

"mode": "armed",

- "floor": {"min": 1, "min_release": "v0.28.1"},

- "authorization": "TO-CONFIRM: root-signed envelope of {schema: 1, purpose: \"moves-protocol\", deployment_bucket: \"carlos-dev-640012953448\", key: \"control/moves-protocol.json\", sha256: <sha256 of the exact floor bytes>}; no tool on main produces it offline (see README)"

+ "floor": {

+ "min": 1,

+ "min_release": "v0.28.2"

+ },

+ "authorization": "BLOCKED on gap 1 (fix ships in v0.28.2): root-signed envelope of {schema: 1, purpose: \"moves-protocol\", deployment_bucket: \"carlos-dev-640012953448\", key: \"control/moves-protocol.json\", sha256: <sha256 of the exact floor bytes>}, signed on the trusted host by the new claims run phase without publishing"

}

diff --git a/docs/superpowers/notes/claim-trial-inputs/signing-host.md b/docs/superpowers/notes/claim-trial-inputs/signing-host.md

index e2ce6ba0a..c725c366b 100644

--- a/docs/superpowers/notes/claim-trial-inputs/signing-host.md

+++ b/docs/superpowers/notes/claim-trial-inputs/signing-host.md

@@ -94,7 +94,7 @@ The key goes from the SSM response straight into a `0600` file on tmpfs (`/run`)

## Getting jq and the carlos CLI there

On DOCS-T1, before launching:

-1. Download carlos v0.28.1 `carlos-linux-arm64`, with its `SHA256SUMS` and `SHA256SUMS.sig`, from the public release. Verify the signature as the README's "Releasing the platform" verification does, then `sha256sum -c`. Record the sha256.

+1. Download the carlos CLI `carlos-linux-arm64` (v0.28.1 for step 5; v0.28.2 for step 6's policy signing and step 7), with its `SHA256SUMS` and `SHA256SUMS.sig`, from the public release. Verify the signature as the README's "Releasing the platform" verification does, then `sha256sum -c`. Record the sha256.

2. Download jq 1.7.1 `jq-linux-arm64` and the release's `sha256sum.txt` from `github.com/jqlang/jq/releases/tag/jq-1.7.1`, then check it with `sha256sum -c`. Record the sha256.

3. Upload both to `s3://carlos-dev-640012953448/claim-signer/<run-id>/`.

@@ -103,12 +103,12 @@ On the signer, as root:

```bash

aws s3 cp s3://carlos-dev-640012953448/claim-signer/<run-id>/carlos-linux-arm64 /usr/local/bin/carlos

aws s3 cp s3://carlos-dev-640012953448/claim-signer/<run-id>/jq-linux-arm64 /usr/local/bin/jq

-printf '%s %s\n' '<carlos v0.28.1 sha256>' /usr/local/bin/carlos '<jq 1.7.1 sha256>' /usr/local/bin/jq | sha256sum -c

+printf '%s %s\n' '<carlos CLI sha256>' /usr/local/bin/carlos '<jq 1.7.1 sha256>' /usr/local/bin/jq | sha256sum -c

chmod 0755 /usr/local/bin/carlos /usr/local/bin/jq

/usr/local/bin/carlos version

```

-Expected: both `OK`, then `carlos v0.28.1`. Both sha256 values are TO-CONFIRM: v0.28.1 is not published yet, and the jq value is recorded at download.

+Expected: both `OK`, then the expected version (`carlos v0.28.1` for step 5, `carlos v0.28.2` from step 6). Both sha256 values are TO-CONFIRM: neither release is published yet, and the jq value is recorded at download.

## Create (each part needs Paul's go)

diff --git a/docs/superpowers/notes/claim-trial-inputs/sophie.json b/docs/superpowers/notes/claim-trial-inputs/sophie.json

index 93694518d..571dfe272 100644

--- a/docs/superpowers/notes/claim-trial-inputs/sophie.json

+++ b/docs/superpowers/notes/claim-trial-inputs/sophie.json

@@ -6,5 +6,5 @@

"pool": "console",

"aws_region": "eu-west-1",

"instance_id": "i-05498eada6f0afd23",

- "operator": "TO-CONFIRM: the approving operator's identity string"

+ "operator": "TO-CONFIRM (Paul): the approving operator's identity; suggested default paul@keymail.dev"

}

diff --git a/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md b/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md

index 72ce32f97..852ff814c 100644

--- a/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md

+++ b/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md

@@ -191,13 +191,13 @@ Pass: all twelve are root-owned regular files in `/etc/systemd/system`; the edge

## Blockers

-1. **Release.** Resolved: v0.28.0, cut from 26065378 (Plan 14 Parts 2 and 3, the activation tools, e8e961dd), is fully rolled on dev (2026-10-18). Step 1.

+1. **Release.** Resolved: v0.28.0, cut from 26065378 (Plan 14 Parts 2 and 3, the activation tools, e8e961dd), is fully rolled on dev (2026-10-18). Step 1. Two dev-only releases follow, each rolled to dev with Paul's go: v0.28.1 (the box-record verb), which unblocks step 5, and v0.28.2 (gap 1 and 2 fixes), which step 6 waits for.

2. **Empty app segment.** 267 objects under `apps/bab//` (P5). Source: leo's app-less `proof*` routes, removed (2026-10-16). Cleanup waits for the e8e961dd release to reach leo and for Paul's approval. Step 2.

3. **IAM.** Leo's object-version actions were applied on 2026-10-18 (targeted, `0 to add, 1 to change, 0 to destroy`): the claim's data store lists, reads and deletes object versions in `carlos-dev-ie-640012953448` on the seed and cold-wake paths. The fence-writer role (`carlos-dev-ie-b-fence-writer`, bootstrap user `carlos-dev-ie-b-fence-writer-root`, no access key yet) and the deployment bucket policy were applied on 2026-10-18 from the saved targeted plan (`5 added, 0 changed, 0 destroyed`) and merged as platform-infrastructure#46 (`beb346b`). The bucket policy names that role as the only fence writer. After the apply, wakecheck still served on sophie (200) and leo answered `waking elsewhere` (sophie held the lease), with no AccessDenied in either box's journals. Step 3.

4. **Box identity records.** Step 5's enrollment needs each box's signed AWS identity record at `control/boxes/<box>.json`. None exists, and none has ever been written: the publisher (`internal/host/boxrecord.go`, `boxRecordLoop`) runs only with `CARLOS_REGION_HA` on, which is off on every dev box. Leo's and sophie's records must be published before step 5. Paul ruled a reviewed one-off publish, with region HA staying off.

The verb `carlos system box publish-record` (branch `box-publish-record`, merging now) ships in v0.28.1, dev only, and is the supported way. It replaces the agent's region-HA-only publisher for this trial; step 5.0 runs it once per box. The record is AWS-signed (the EC2 instance identity document and AWS's signature over it), not signed by the box or the operator, and grants nothing until enrollment reads it.

-5. **Signed armed policy and system identity.** Step 6's `guard-arm` needs an armed `policy.json` (the floor plus a root-signed `moves-protocol` authorization) and a signed v0.28.1 system identity at `control/system/router/releases/v0.28.1.json`. No tool on main signs the policy without publishing it, and nothing publishes a system identity; the dev bucket has none. Details in `docs/superpowers/notes/claim-trial-inputs/README.md`, "Gaps found while drafting". For platform-1e.

+5. **Signed armed policy and system identity (step 6 onwards).** Step 6's `guard-arm` needs an armed `policy.json` (the floor plus a root-signed `moves-protocol` authorization) and a signed system identity at `control/system/router/releases/<tag>.json`. On main, nothing signs the policy without publishing it, and nothing publishes a system identity; the dev bucket has none. platform-1e confirmed both gaps on 2026-10-18 and is building the fixes, with Paul's go: (a) a `claims run` phase that signs the armed policy's authorization for a floor on the trusted host without publishing anything; (b) the release workflow publishing the signed system identity (router and console), and the protected console install with its `.prev`. Both ship in v0.28.2, so the floor's `min_release` is v0.28.2. Step 5 does not need them. Details in `docs/superpowers/notes/claim-trial-inputs/README.md`.

## Accepted trial gaps

@@ -335,7 +335,7 @@ Run signing phases on the trusted operator host. Run box installers as root.

**No new tools on the boxes (platform-1e, 2026-10-17).** `jq` is not installed on leo or sophie, and nothing is installed for the trial. Every `jq` line runs on the trusted signing host. A box writes raw JSON (`inspect.json`, `key-proof.json`) to a file; the trusted host fetches it over SSM, parses it there, and stages the results (`roster.json`, `rev`, `le`) back on the box over SSM. The box commands read those files with `cat`. A wrong or stale staged roster is refused, because `console-config` and `evidence-key` verify the roster's signature and its revision against `--expect-revision`.

Where they run:

-- **The trusted signing host:** a throwaway dev instance, `carlos-claim-signer`, proposed in `docs/superpowers/notes/claim-trial-inputs/signing-host.md` (root-runner pattern, SSM only, its own role that may read `/carlos/release-key`). It holds `/root/claim-trial` with the inputs, the key in a `0600` tmpfs file at `/run/claim-signer/release.key`, `jq` and the carlos v0.28.1 CLI, both checked by sha256. It runs only the signing helpers (`refresh`, `apply_plan`, `phase`) with its instance role; set `KEY=/run/claim-signer/release.key` and `CARLOS=/usr/local/bin/carlos`, and leave out `export AWS_PROFILE=kass`. The release signing key never goes on either box.

+- **The trusted signing host:** a throwaway dev instance, `carlos-claim-signer`, proposed in `docs/superpowers/notes/claim-trial-inputs/signing-host.md` (root-runner pattern, SSM only, its own role that may read `/carlos/release-key`). It holds `/root/claim-trial` with the inputs, the key in a `0600` tmpfs file at `/run/claim-signer/release.key`, `jq` and the carlos CLI (v0.28.1 for step 5, v0.28.2 from step 6), both checked by sha256. It runs only the signing helpers (`refresh`, `apply_plan`, `phase`) with its instance role; set `KEY=/run/claim-signer/release.key` and `CARLOS=/usr/local/bin/carlos`, and leave out `export AWS_PROFILE=kass`. The release signing key never goes on either box.

- **The operator host (DOCS-T1, profile `kass`):** runs the box helpers below (`ssm_run`, `box_get`, `box_put`, `box_inspect`) and the `jq` parsing for the boxes. Files move between the signer and DOCS-T1 through `s3://carlos-dev-640012953448/claim-signer/<run-id>/`.

- **Leo and sophie:** attended root shells for the box blocks, which use only the platform binary, `systemctl` and the shell. Inputs are staged at the exact paths shown, root-owned, private files `0600`, no symlinks or extra hard links. Staging is a checkpoint, not permission to make up signatures.

@@ -343,6 +343,8 @@ The controller supplies, and Paul approves, the concrete inputs: the signed rele

## Step 5. Roster, enrollment and console enrollment

+Unblocked once v0.28.1 is on dev. It needs Paul's approval of the step 5 package (the inputs in `docs/superpowers/notes/claim-trial-inputs/`, the signing host, and the box-record publishes), but not the gap 1 and 2 fixes.

Paul's go: once for step 5.

### 5.0 Box identity records

@@ -478,6 +480,8 @@ On failure: hold. A partly applied phase is resumed from the latest authenticate

## Step 6. Arm leo's guard and start the guarded console

+Waits for v0.28.2 on dev: `policy.json` is signed on the trusted host by v0.28.2's new `claims run` phase (blocker 5a), `identity.json` is the v0.28.2 system identity the release workflow publishes (5b), and sophie's `--console` path and its `.prev` come from v0.28.2's console install (5b). Never hand-make any of them.

Paul's go: once for step 6. It restarts `console.service` on sophie, which briefly interrupts the dev console.

On leo, after the release and protected current and previous binaries are installed:

@@ -1416,6 +1420,6 @@ For platform-1e:

2. For a later teardown out of hold: how do writes made under the claim reach the claims-off restore path?

3. Answered 2026-10-18: leo's object-version actions are applied for the trial; the box-records bucket policy goes with the fence-writer role in platform-infrastructure#46.

4. Box identity records: `carlos system box publish-record` ships in v0.28.1, dev only (step 5.0). The v0.28.1 dev roll comes before step 5.

-6. The signed armed policy and the v0.28.1 system identity (blocker 5): which tool signs the policy without publishing it, and who publishes the identity?

-7. The step 5 inputs marked `TO-CONFIRM` in `docs/superpowers/notes/claim-trial-inputs/README.md`, and the signing host proposal in `signing-host.md`.

+6. Answered 2026-10-18: platform-1e builds the armed policy signing phase and the published system identity with the protected console install, in v0.28.2 (blocker 5). Step 6 waits for it; step 5 does not.

+7. Still open in `docs/superpowers/notes/claim-trial-inputs/README.md`: the operator identity (Paul; suggested default `paul@keymail.dev`), the console enrollment token, the v0.28.1 and v0.28.2 artifacts, and the signing host values. Namespace `platform`, sophie's pool `console` and console ID `dev-console` are confirmed.

5. The console's mutation classifier lets it delete under `control/boxes/` and `control/box-volumes/`, which the new box-records bucket policy refuses: amadan carlos/platform#302.