amadan
Instance key provision: Astra round 5 brief
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+23
−0
docs/superpowers/plans/CODEX-PLAN-INSTANCE-KEY-BRIEF-5.md+23 −0
CI cancelled — superseded by a newer push — run details
CI log
=== gate === cd launchctx && go vet ./... && go test ./... -count=1 ok amadan.net/carlos/platform.git/launchctx 0.014s ? amadan.net/carlos/platform.git/launchctx/controlname [no test files] ? amadan.net/carlos/platform.git/launchctx/wireid [no test files] go vet ./... gofmt -l .: clean go test ./... -count=1 -timeout 30m amadan: job cancelled — a newer push superseded it
diff --git a/docs/superpowers/plans/CODEX-PLAN-INSTANCE-KEY-BRIEF-5.md b/docs/superpowers/plans/CODEX-PLAN-INSTANCE-KEY-BRIEF-5.md| new file mode 100644 |
| index 000000000..487ed9742 |
| --- /dev/null |
| +++ b/docs/superpowers/plans/CODEX-PLAN-INSTANCE-KEY-BRIEF-5.md |
| @@ -0,0 +1,23 @@ |
| +# Astra round 5 brief: instance key provision, rev 4 |
| + |
| +**Review:** `docs/superpowers/plans/2026-10-10-instance-key-provision.md`, rev 4 (3e42e8e7). It answers your round 4 (`CODEX-PLAN-INSTANCE-KEY-R4.md`). **Ruling 26 is Paul's decision:** a replica gets its home's key. It replaces rulings 17 and 25. The rev 3.1 strip is reverted. |
| + |
| +**Mechanism.** Before any replica process starts, the agent allows it to run in only two cases: |
| +- with exactly its home's key, verified against the home key's digest; |
| +- with no key but with a control socket, so that the helper refuses instead of minting. |
| + |
| +With no key and no socket (seeds, claim launches before O6, a failed socket bind), the agent refuses the launch itself. |
| + |
| +A pre-roll check records verified home keys in `CARLOS_REPLICA_HOME_KEYS` before any box is upgraded. Replicas that already share their home's configured key therefore keep working. |
| + |
| +**New obligation O8 (replica placements, #162).** The replica record names its home. The replica reads the home's published `<host>.env` item, verifies it by digest, and writes it create-only. Until O8 lands, a keyless replica refuses to start. |
| + |
| +**Judge:** |
| +1. Are both round 4 findings closed? |
| +2. Is the replica refusal reliable on every launch path (seed, spawn, nested, claim, socket-bind failure)? |
| +3. Can a replica ever run with a key other than its home's? |
| +4. Is the pre-roll check sound? Is `CARLOS_REPLICA_HOME_KEYS` safe: is it exposed to the tenant, is it in logs? |
| +5. Is O8 well-defined, and is its fallback safe? |
| +6. Anything new? |
| + |
| +Give findings P1/P2/P3 with file:line, then a verdict: ready to build, or not. |