amadan
spec: scope the deploy-credential claim to adoption, not serving
Summary
States that "adopts in seconds" means staged and repointed. Unit-backed routes (titogo) serve as soon as the unit restarts. Awake exec-backed instances are not cycled at adoption today and wait for the activator sweep; that fix and the immediate-handover spec belong to other work.
Agent notes
Fact relayed from the platform session (peer platform-f9) at Paul's request. I confirmed the two cited symbols exist at main 8d8e4bae (rootRestartRoute agent.go:3033, ConvergeGrace activator.go:532). The 110-200s measurement is theirs and I did not reproduce it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+24
−1
docs/superpowers/specs/2026-10-05-deploy-credential-design.md+24 −1
CI cancelled — superseded by a newer push — run details
diff --git a/docs/superpowers/specs/2026-10-05-deploy-credential-design.md b/docs/superpowers/specs/2026-10-05-deploy-credential-design.md| index ea6793f3a..8c872d0ca 100644 |
| --- a/docs/superpowers/specs/2026-10-05-deploy-credential-design.md |
| +++ b/docs/superpowers/specs/2026-10-05-deploy-credential-design.md |
| @@ -56,8 +56,30 @@ holds bucket credentials, so the console is their only door. |
| 4. A console rolled back to a build from before this change refuses the new |
| credential at every door. |
| +**What "adopts in seconds" means here.** This spec claims adoption: the box |
| +stages the new version and repoints to it within seconds of the promote. It |
| +does not claim the new build is serving within seconds. |
| + |
| +- For a unit-backed route, which is what titogo's fleet runs on, serving |
| + follows adoption as soon as the unit restarts, so #229's goal stands. |
| +- For an awake exec-backed instance, adoption does not cycle the running |
| + process today. On a real box the root adopt pass stages and repoints |
| + through `rootRestartRoute` (`internal/host/agent.go:3033`), which cycles |
| + no exec child, and the agent then sees the version already current and |
| + never calls its own restart. The activator's sweep catches it later: a |
| + 30-second tick plus `ConvergeGrace` of 90 seconds |
| + (`internal/activator/activator.go:532`). The platform session measured |
| + 110 to 200 seconds from ship to serving on the flagship over 3 to 5 |
| + October. |
| + |
| +That gap is being fixed on its own branch by another session, and the |
| +handover that makes a shipped release reach running instances immediately |
| +is a separate spec. Neither is part of this one. |
| + |
| **Non-goals** |
| +- Making an adopted release serve sooner on exec-backed instances (above). |
| + |
| - Scopes that name pipeline channels (ruling R2). |
| - Narrowing or changing existing `publish` credentials. |
| - Expiry on service credentials. Rotate and revoke stay as they are. |
| @@ -320,7 +342,8 @@ credentials already are, and the mint line records the rungs. |
| `CARLOS_DEPLOYMENT_BUCKET` (and its AWS role, if nothing else in the |
| workflow uses it); sets `CARLOS_SERVICE_TOKEN` and |
| `CARLOS_CONSOLE`. This is a titogo change, tracked on #229. |
| -5. Confirm on the box that an edge promote adopts within seconds, then |
| +5. Confirm on the box that an edge promote is adopted (staged and |
| + repointed) within seconds, then |
| remove `carlos-adopt.timer.d/canary-cadence.conf`. |
| 6. Remove the scoped release key and its grant from the runner's secrets. |
| The grant expires on its own within its 365-day life. |