amadan
claim-prev-rehearsal: record census-ruling-claim-prev-rehearsal-fix1
platform-1e accepted the fix round 1 overlay as proposed: channelInstall.run's basis corrected (F,J4), refreshPrev re-pinned, openChannelPolicy new (F,J4), readChannelPolicy removed, the internal/host envelope re-pinned; the seal stands, no 9B8 entry.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
3 files changed,
+9
−8
docs/superpowers/notes/census-proposal-claim-prev-rehearsal.md+2 −2internal/provision/plan14_root_reads_test.go+3 −2internal/provision/testdata/plan14-root-reads-claim-prev-rehearsal-fix1.tsv+4 −4
CI passed — run details
CI log
=== gate ===
cd launchctx && go vet ./... && go test ./... -count=1
ok amadan.net/carlos/platform.git/launchctx 0.011s
? amadan.net/carlos/platform.git/launchctx/controlname [no test files]
? amadan.net/carlos/platform.git/launchctx/wireid [no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok github.com/carlosframework/platform 317.110s
? github.com/carlosframework/platform/cmd/changelog [no test files]
ok github.com/carlosframework/platform/cmd/console 2.900s
ok github.com/carlosframework/platform/cmd/moveprobe 93.224s
ok github.com/carlosframework/platform/cmd/zddprobe 0.706s
ok github.com/carlosframework/platform/internal/activator 251.510s
ok github.com/carlosframework/platform/internal/agentsock 0.024s
ok github.com/carlosframework/platform/internal/alerting 0.005s
ok github.com/carlosframework/platform/internal/analytics 0.020s
ok github.com/carlosframework/platform/internal/appconfig 2.458s
ok github.com/carlosframework/platform/internal/apperr 0.081s
ok github.com/carlosframework/platform/internal/applog 0.155s
ok github.com/carlosframework/platform/internal/awsinv 0.006s
ok github.com/carlosframework/platform/internal/boxchoice 0.005s
ok github.com/carlosframework/platform/internal/boxid 0.832s
? github.com/carlosframework/platform/internal/boxid/boxidtest [no test files]
? github.com/carlosframework/platform/internal/boxid/internal/signtest [no test files]
ok github.com/carlosframework/platform/internal/boxvolumes 0.012s
ok github.com/carlosframework/platform/internal/caps 0.013s
ok github.com/carlosframework/platform/internal/certwarm 0.002s
ok github.com/carlosframework/platform/internal/cgroup 0.699s
ok github.com/carlosframework/platform/internal/changelog 0.327s
ok github.com/carlosframework/platform/internal/claimactivation 0.802s
ok github.com/carlosframework/platform/internal/clamd 0.055s
? github.com/carlosframework/platform/internal/cliflag [no test files]
ok github.com/carlosframework/platform/internal/console 406.964s
? github.com/carlosframework/platform/internal/controlname [no test files]
? github.com/carlosframework/platform/internal/controlsock [no test files]
ok github.com/carlosframework/platform/internal/dbdoor 6.501s
ok github.com/carlosframework/platform/internal/dbdoor/dbdoortest 0.015s
ok github.com/carlosframework/platform/internal/dbverify 0.008s
ok github.com/carlosframework/platform/internal/dnsrec 0.003s
ok github.com/carlosframework/platform/internal/docsite 0.005s
ok github.com/carlosframework/platform/internal/domains 2.360s
ok github.com/carlosframework/platform/internal/doorkey 0.010s
ok github.com/carlosframework/platform/internal/economics 0.004s
ok github.com/carlosframework/platform/internal/edge 44.952s
? github.com/carlosframework/platform/internal/edgeproof [no test files]
ok github.com/carlosframework/platform/internal/edgesfile 0.009s
ok github.com/carlosframework/platform/internal/fleetapi 0.137s
ok github.com/carlosframework/platform/internal/gate 1.656s
ok github.com/carlosframework/platform/internal/genselect 0.023s
ok github.com/carlosframework/platform/internal/geo 0.015s
ok github.com/carlosframework/platform/internal/geoip 0.042s
ok github.com/carlosframework/platform/internal/historyreadback 0.159s
ok github.com/carlosframework/platform/internal/host 182.122s
ok github.com/carlosframework/platform/internal/hostactors 5.980s
ok github.com/carlosframework/platform/internal/hostactors/awsmembership 0.006s
ok github.com/carlosframework/platform/internal/hostbox 2.876s
ok github.com/carlosframework/platform/internal/hostclaim 0.591s
ok github.com/carlosframework/platform/internal/hostenv 0.004s
ok github.com/carlosframework/platform/internal/hostevidence 0.006s
ok github.com/carlosframework/platform/internal/hostexec 4.780s
ok github.com/carlosframework/platform/internal/hostfence 0.033s
ok github.com/carlosframework/platform/internal/hostfiles 10.500s
ok github.com/carlosframework/platform/internal/hostfloor 0.014s
ok github.com/carlosframework/platform/internal/hostguard 1.002s
ok github.com/carlosframework/platform/internal/hostops 1.629s
? github.com/carlosframework/platform/internal/hostops/fencerelease [no test files]
ok github.com/carlosframework/platform/internal/hostops/internal/fencerelease 0.003s
ok github.com/carlosframework/platform/internal/hostquarantine 0.006s
ok github.com/carlosframework/platform/internal/hostrelocate 0.477s
ok github.com/carlosframework/platform/internal/hostresolve 0.157s
ok github.com/carlosframework/platform/internal/hostwrite 0.004s
ok github.com/carlosframework/platform/internal/infraview 0.002s
ok github.com/carlosframework/platform/internal/instancectl 5.220s
ok github.com/carlosframework/platform/internal/instanceexec 2.723s
ok github.com/carlosframework/platform/internal/instancefs 0.005s
ok github.com/carlosframework/platform/internal/instancekey 0.005s
ok github.com/carlosframework/platform/internal/instanceupdates 0.007s
ok github.com/carlosframework/platform/internal/layout 1.542s
ok github.com/carlosframework/platform/internal/lbhealth 0.002s
ok github.com/carlosframework/platform/internal/lease 9.820s
ok github.com/carlosframework/platform/internal/lease/leasetest 0.007s
ok github.com/carlosframework/platform/internal/ledger 0.012s
ok github.com/carlosframework/platform/internal/mail 0.171s
ok github.com/carlosframework/platform/internal/maintenance 0.081s
ok github.com/carlosframework/platform/internal/maintenanceexec 5.515s
ok github.com/carlosframework/platform/internal/maintenanceguard 0.076s
ok github.com/carlosframework/platform/internal/metrics 0.008s
ok github.com/carlosframework/platform/internal/moves 21.065s
ok github.com/carlosframework/platform/internal/moves/archive 0.810s
ok github.com/carlosframework/platform/internal/objstore 0.185s
ok github.com/carlosframework/platform/internal/ops 0.183s
ok github.com/carlosframework/platform/internal/park 0.213s
ok github.com/carlosframework/platform/internal/privatefile 0.006s
ok github.com/carlosframework/platform/internal/provision 29.500s
ok github.com/carlosframework/platform/internal/publicrelease 0.011s
? github.com/carlosframework/platform/internal/regionname [no test files]
ok github.com/carlosframework/platform/internal/registry 5.456s
ok github.com/carlosframework/platform/internal/relay 7.238s
ok github.com/carlosframework/platform/internal/release 23.968s
ok github.com/carlosframework/platform/internal/rollout 3.657s
ok github.com/carlosframework/platform/internal/rolloutwords 0.005s
ok github.com/carlosframework/platform/internal/rootaws 0.007s
ok github.com/carlosframework/platform/internal/rootparticipation 0.058s
ok github.com/carlosframework/platform/internal/rootstate 0.029s
ok github.com/carlosframework/platform/internal/runs 0.576s
ok github.com/carlosframework/platform/internal/s3compat 0.005s
ok github.com/carlosframework/platform/internal/safefile 0.006s
ok github.com/carlosframework/platform/internal/schedule 2.513s
ok github.com/carlosframework/platform/internal/seeds 0.013s
ok github.com/carlosframework/platform/internal/sim/hostlife 9.463s
ok github.com/carlosframework/platform/internal/sim/litestreamfacts 3.798s
ok github.com/carlosframework/platform/internal/status 0.076s
ok github.com/carlosframework/platform/internal/steering 0.006s
ok github.com/carlosframework/platform/internal/stopevidence 0.400s
ok github.com/carlosframework/platform/internal/svcrole 0.002s
ok github.com/carlosframework/platform/internal/telemetry 0.004s
ok github.com/carlosframework/platform/internal/termfence 0.004s
ok github.com/carlosframework/platform/internal/tunnelclient 0.004s
ok github.com/carlosframework/platform/internal/unixdial 0.003s
ok github.com/carlosframework/platform/internal/updatewords 0.005s
ok github.com/carlosframework/platform/internal/usage 0.004s
ok github.com/carlosframework/platform/internal/version 0.002s
ok github.com/carlosframework/platform/internal/vet 1.559s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
linux/arm64 carlos binary: 49414306 bytes (ceiling 52000000)
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
minio: cached, digest verified
mc: cached, digest verified
minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
buckets and scoped user ready
=== RUN TestDeliveredContractMinio
=== RUN TestDeliveredContractMinio/put
=== RUN TestDeliveredContractMinio/get_round-trips_the_body
=== RUN TestDeliveredContractMinio/list_shows_the_key
=== RUN TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN TestDeliveredContractMinio/delete_removes_it
=== RUN TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
--- PASS: TestDeliveredContractMinio/put (0.00s)
--- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
--- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
--- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
--- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok github.com/carlosframework/platform/internal/objstore 0.023s
=== RUN TestT4StorageProbeMinio
2026/10/18 13:50:40 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18DFA3F2D636D2A8, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.01s)
PASS
ok github.com/carlosframework/platform/internal/host 0.022s
minio contract: PASS
diff --git a/docs/superpowers/notes/census-proposal-claim-prev-rehearsal.md b/docs/superpowers/notes/census-proposal-claim-prev-rehearsal.md| index 225453681..8eea106d9 100644 |
| --- a/docs/superpowers/notes/census-proposal-claim-prev-rehearsal.md |
| +++ b/docs/superpowers/notes/census-proposal-claim-prev-rehearsal.md |
| @@ -32,9 +32,9 @@ No new bucket writer. install-channel writes only local files (`carlos.prev`, it |
| The rewritten root-runner witness (`activation_console_rootrunner_linux_test.go`) and the new `installchannel_policy_test.go` are tests and are outside the census. |
| -## Fix round 1 (PROPOSED) |
| +## Fix round 1 (RULED) |
| -Overlay `internal/provision/testdata/plan14-root-reads-claim-prev-rehearsal-fix1.tsv`, loaded after the ruled overlay, every row `rev3=PROPOSED-claim-prev-rehearsal-fix1`. Everything is in the `--policy` path; without `--policy` nothing changes. |
| +Status: RULED. platform-1e accepted every row as proposed on 2026-10-18 (census-ruling-claim-prev-rehearsal-fix1). Overlay `internal/provision/testdata/plan14-root-reads-claim-prev-rehearsal-fix1.tsv`, loaded after the ruled overlay, every row `rev3=census-ruling-claim-prev-rehearsal-fix1`. Everything is in the `--policy` path; without `--policy` nothing changes. |
| What changed: |
diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go| index 2bebbf108..f070466ef 100644 |
| --- a/internal/provision/plan14_root_reads_test.go |
| +++ b/internal/provision/plan14_root_reads_test.go |
| @@ -868,8 +868,9 @@ func TestPlan14RootReadCensus(t *testing.T) { |
| } |
| // Census overlay claim-prev-rehearsal-fix1 (fix round 1: mandatory |
| // carlos.prev record, unfinished-update refusal, the census branch for |
| - // --policy, the hardened policy read), loaded last. PROPOSED |
| - // (docs/superpowers/notes/census-proposal-claim-prev-rehearsal.md, |
| + // --policy, the hardened policy read), loaded last, under |
| + // census-ruling-claim-prev-rehearsal-fix1 (platform-1e, accepted as |
| + // proposed; docs/superpowers/notes/census-proposal-claim-prev-rehearsal.md, |
| // "Fix round 1"). It adds no accepted-legacy row, so the seal stands. |
| if err = loadRootReadInventory(filepath.Join(root, "internal/provision/testdata/plan14-root-reads-claim-prev-rehearsal-fix1.tsv"), &inv, true); err != nil { |
| t.Fatal(err) |
diff --git a/internal/provision/testdata/plan14-root-reads-claim-prev-rehearsal-fix1.tsv b/internal/provision/testdata/plan14-root-reads-claim-prev-rehearsal-fix1.tsv| index 460758745..2eb55b452 100644 |
| --- a/internal/provision/testdata/plan14-root-reads-claim-prev-rehearsal-fix1.tsv |
| +++ b/internal/provision/testdata/plan14-root-reads-claim-prev-rehearsal-fix1.tsv |
| @@ -1,8 +1,8 @@ |
| -# Census overlay claim-prev-rehearsal-fix1 (fix round 1: Astra's metadata finding and platform-00's I1, I2, M3, M5, as ruled by the controller), loaded LAST, after claim-prev-rehearsal. PROPOSED, not ruled: docs/superpowers/notes/census-proposal-claim-prev-rehearsal.md, section "Fix round 1". |
| +# Census overlay claim-prev-rehearsal-fix1 (fix round 1: Astra's metadata finding and platform-00's I1, I2, M3, M5, as ruled by the controller), loaded LAST, after claim-prev-rehearsal. RULED by platform-1e 2026-10-18 as census-ruling-claim-prev-rehearsal-fix1: every row ACCEPTED as proposed (channelInstall.run basis corrected at F,J4, refreshPrev re-pinned, openChannelPolicy new, readChannelPolicy removed, internal/host envelope re-pinned; the seal stands, no 9B8 entry); docs/superpowers/notes/census-proposal-claim-prev-rehearsal.md, section "Fix round 1". |
| # install-channel --policy only; without --policy nothing changes. carlos.prev's version record is mandatory in the --policy path (completePrev: under the prev lock the old verdicts and record are removed, carlos copied when refreshing, the record written and read back, every failure fatal, then the floor's judgement by notePrev without a replace), and the --policy "already installed" answer requires that record. An open update journal or update-begun marker refuses (guardArmIdle). The --policy applier reads the root participation census (rootMovesFloorIdentity), so a census box takes the update's root moves floor branch. The policy file is opened with O_NOFOLLOW and O_NONBLOCK, fstat'd regular and capped at 64 KiB (openChannelPolicy); readChannelPolicy keeps no read site of its own (@remove). |
| # channelInstall.run's digest and class are unchanged; only its basis is corrected (M5). The seal stands: no accepted-legacy row. The 9B8 inventory is unchanged. |
| @coverage internal/host ebc571e3abd07501ffcd2992ad2f2269c242b0dd5c792314662c6988a6264e34 |
| @remove internal/host/installchannel.go readChannelPolicy |
| -internal/host/installchannel.go channelInstall.run authority F,J4 rev3=PROPOSED-claim-prev-rehearsal-fix1;basis=carlos system install-channel (root): at a fresh box's start-up, and with --policy also at an updated box's attended root shell before the host floor is published; its one read site opens root's apply lock; the install goes through verifyPointer, hostfloor.CheckImage (against the published floor, or with --policy the verified policy floor) and stageCandidate into both protected slots, or with --policy on an updated box at the channel head through refreshPrev; it refuses a box whose guard is armed or that already runs another release, and with --policy a box whose update has not finished file:OpenFile@196 f0cdb6dd28e83da282c3b0d7bc2012dcd80db181a8cecbf1a2db6bcc41d1d5e3 |
| -internal/host/installchannel.go channelInstall.refreshPrev authority F,J4 rev3=PROPOSED-claim-prev-rehearsal-fix1;identity=uid 0 at the box's attended root shell (carlos system install-channel --policy);basis=under the apply lock, after the armed-guard, unfinished-update, other-release and floor refusals: carlos must hash, through slotState's O_NOFOLLOW descriptor, to the channel release's signed artifact sha256; its one read site Lstats carlos.prev to refuse a symlink or anything but a regular file; completePrev then removes the old verdicts and version record, copies carlos over carlos.prev and writes and reads back the record, each step mandatory; it then reaches notePrev and through it the floor's judgement (judgePrevWith and judgeSeedsPrev, or with a root participation census the root moves floor judge), which can open the registry as root when a legacy local floor exists; both slots are re-hashed before the identity is kept; nothing is fetched or executed and applied.json and seen.json are not written file:Lstat@907 1426d3230768f721a7daf2eadd42590d69125ade16c81d6ff70fdb89543b2abe |
| -internal/host/installchannel_linux.go openChannelPolicy authority F,J4 rev3=PROPOSED-claim-prev-rehearsal-fix1;identity=uid 0 at the box's attended root shell (carlos system install-channel --policy);basis=reads the operator-staged --policy file once, before the apply lock or any store read: opened with O_NOFOLLOW (a symlink is refused) and O_NONBLOCK (a FIFO does not block), fstat'd to be a regular file of at most 64 KiB, then read from the descriptor up to that cap; the bytes are used only after channelPolicy verifies the root-signed moves-protocol authorization for this deployment's bucket under CARLOS_RELEASE_PUBKEY, and a published floor must equal them byte for byte file:Open@79,file:ReadAll@485,file:Stat@263 eb5725bd24aa51f5d4f93b01a065351a278bb82cbf013a106b2f1fba36987f94 |
| +internal/host/installchannel.go channelInstall.run authority F,J4 rev3=census-ruling-claim-prev-rehearsal-fix1;basis=carlos system install-channel (root): at a fresh box's start-up, and with --policy also at an updated box's attended root shell before the host floor is published; its one read site opens root's apply lock; the install goes through verifyPointer, hostfloor.CheckImage (against the published floor, or with --policy the verified policy floor) and stageCandidate into both protected slots, or with --policy on an updated box at the channel head through refreshPrev; it refuses a box whose guard is armed or that already runs another release, and with --policy a box whose update has not finished file:OpenFile@196 f0cdb6dd28e83da282c3b0d7bc2012dcd80db181a8cecbf1a2db6bcc41d1d5e3 |
| +internal/host/installchannel.go channelInstall.refreshPrev authority F,J4 rev3=census-ruling-claim-prev-rehearsal-fix1;identity=uid 0 at the box's attended root shell (carlos system install-channel --policy);basis=under the apply lock, after the armed-guard, unfinished-update, other-release and floor refusals: carlos must hash, through slotState's O_NOFOLLOW descriptor, to the channel release's signed artifact sha256; its one read site Lstats carlos.prev to refuse a symlink or anything but a regular file; completePrev then removes the old verdicts and version record, copies carlos over carlos.prev and writes and reads back the record, each step mandatory; it then reaches notePrev and through it the floor's judgement (judgePrevWith and judgeSeedsPrev, or with a root participation census the root moves floor judge), which can open the registry as root when a legacy local floor exists; both slots are re-hashed before the identity is kept; nothing is fetched or executed and applied.json and seen.json are not written file:Lstat@907 1426d3230768f721a7daf2eadd42590d69125ade16c81d6ff70fdb89543b2abe |
| +internal/host/installchannel_linux.go openChannelPolicy authority F,J4 rev3=census-ruling-claim-prev-rehearsal-fix1;identity=uid 0 at the box's attended root shell (carlos system install-channel --policy);basis=reads the operator-staged --policy file once, before the apply lock or any store read: opened with O_NOFOLLOW (a symlink is refused) and O_NONBLOCK (a FIFO does not block), fstat'd to be a regular file of at most 64 KiB, then read from the descriptor up to that cap; the bytes are used only after channelPolicy verifies the root-signed moves-protocol authorization for this deployment's bucket under CARLOS_RELEASE_PUBKEY, and a published floor must equal them byte for byte file:Open@79,file:ReadAll@485,file:Stat@263 eb5725bd24aa51f5d4f93b01a065351a278bb82cbf013a106b2f1fba36987f94 |