amadan

carlos / platform Public

rootfs: census overlays regenerated after the Luna copy pass (rootfs Plan 1 Task 12)

The copy pass moved the digests of four new units (rootfsimage readDir,
boundedReader.Read, readFile, Tree.writeBlob: their refusals now call
the new constructors; the same read kinds, three at moved offsets) and
runShip's (RFS-1-C32's flag help). The hand-written rootfs-apps-1-new overlay is regenerated with the
same 49 rows, classes and bases (seal 975d70da), and census-propose
re-run for the approvals, runShip's claim naming the flag help (seal
cad94b3a). The card's hand-written sections are added back.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claude 460eec0fb958386ec7169e71e75bdfc0c37e9fe9 parent 03e0c79
4 files changed, +17 −17
  • docs/superpowers/notes/census-proposal-rootfs-apps-1.md +3 −3
  • internal/provision/testdata/plan14-root-reads-chain.tsv +2 −2
  • internal/provision/testdata/plan14-root-reads-rootfs-apps-1-new.tsv +8 −8
  • internal/provision/testdata/plan14-root-reads-rootfs-apps-1.tsv +4 −4

CI cancelled — superseded by a newer push — run details

CI log 
=== gate ===
.amadan/test-gate.sh

amadan: job cancelled — a newer push superseded it
diff --git a/docs/superpowers/notes/census-proposal-rootfs-apps-1.md b/docs/superpowers/notes/census-proposal-rootfs-apps-1.md
index a6eac2646..1be0ebeb3 100644
--- a/docs/superpowers/notes/census-proposal-rootfs-apps-1.md
+++ b/docs/superpowers/notes/census-proposal-rootfs-apps-1.md
@@ -8,17 +8,17 @@ Ruling `census-ruling-rootfs-apps-1`. Every change below keeps the disposition i
| `internal/console/apicli.go` `Server.handleAPIShip` | body | unchanged (1) | rootfs Plan 1 Task 8: takes kind rootfs (meta via shipMeta, the body bound lowered once the kind is known through shipBody), refuses a release of the wrong kind or hibernation before any part is read (release.CheckShipKind), hands a rootfs body to shipRootfsParts and gives its ship slot back once that holds its scratch; a kind refused at publication answers as at the door; refusal sentences named as constants; the same read, no read added |
| `internal/hostops/mutation_boundary_putfrom.go` `conditionalRecordStore.PutFrom` | body | unchanged (1) | rootfs Plan 1 Task 3: the same rootfs image key streams past the record checks beside the GeoIP blob key (a rootfs image is never a record body); the same read, no read added |
| `internal/hostops/mutation_boundary_putfrom.go` `mutationBoundary.PutFrom` | body | unchanged (1) | rootfs Plan 1 Task 3: a create-only put of an exact release rootfs image key (release.IsRootfsArtifactKey) now streams to the raw store after the boundary decides it, bounded by release.MaxRootfsBytes (streamLimit), as a GeoIP blob already did; the same read, no read added |
-| `cli.go` `runShip` | sites | -file:ReadFile | rootfs Plan 1 Task 9: takes --rootfs, --processes, --hibernate, --jit and --check and hands a rootfs ship to runShipRootfs (ship_rootfs.go) before the binary path; the --notes-file ReadFile moved into shipNoteText (its own row, the same read of the file the person named) and the direct-mode version mint into mintDirectVersion; one read site fewer, none added |
+| `cli.go` `runShip` | sites | -file:ReadFile | rootfs Plan 1 Task 9: takes --rootfs, --processes, --hibernate, --jit and --check and hands a rootfs ship to runShipRootfs (ship_rootfs.go) before the binary path; the --notes-file ReadFile moved into shipNoteText (its own row, the same read of the file the person named) and the direct-mode version mint into mintDirectVersion; one read site fewer, none added; Task 12: the --hibernate flag help is RFS-1-C32's new text, the same reads |
Envelopes re-pinned: `.`, `internal/console`, `internal/hostops`, `internal/release`, `internal/rootfsimage`.
-Seal: `873bb2bce9fee9b41568b75653fb1df749465faf533413e9b0132ab4b80a4df0` → `225710f8b5e257ff0f72612b44a516dfe9f4bbd3df057e04b637dbd925dc0578`.
+Seal: `975d70da27b01d118dffe4f262f0bdc7904bb6571a079fd9c21bbb319eb06057` → `cad94b3adca26ad5d13a36a21cf54626200aa14ecc83fcc4e835ce2f6b1f3e8f`.
Overlay: `internal/provision/testdata/plan14-root-reads-rootfs-apps-1.tsv`, appended to `internal/provision/testdata/plan14-root-reads-chain.tsv`.
## Decisions (hand-written, not by census-propose)
-census-propose refuses new units, so these 49 rows are in a second overlay, `internal/provision/testdata/plan14-root-reads-rootfs-apps-1-new.tsv`, written by hand following the chain's overlays and loaded just before the approvals above (seal `945934f5…` → `873bb2bc…`). Each is `legacy accepted-legacy` at J4 with `rev3=census-ruling-rootfs-apps-1` from the start. None is a box unit. The per-unit basis is in the overlay; in short:
+census-propose refuses new units, so these 49 rows are in a second overlay, `internal/provision/testdata/plan14-root-reads-rootfs-apps-1-new.tsv`, written by hand following the chain's overlays and loaded just before the approvals above (seal `945934f5…` → `975d70da…`). Each is `legacy accepted-legacy` at J4 with `rev3=census-ruling-rootfs-apps-1` from the start. None is a box unit. The per-unit basis is in the overlay; in short:
| where | units | runs as | what it reads |
|---|---|---|---|
diff --git a/internal/provision/testdata/plan14-root-reads-chain.tsv b/internal/provision/testdata/plan14-root-reads-chain.tsv
index a7ae6401d..fbac34756 100644
--- a/internal/provision/testdata/plan14-root-reads-chain.tsv
+++ b/internal/provision/testdata/plan14-root-reads-chain.tsv
@@ -3,5 +3,5 @@
# make census-propose appends here; nothing else edits this file.
plan14-root-reads-sec-host-imdsv2-module.tsv 945934f5978ace14dc5a9bae0ed69dfabf29b994504fc843c03d4a633ecd6c6a
plan14-root-reads-sec-deps-dos-bumps.tsv 945934f5978ace14dc5a9bae0ed69dfabf29b994504fc843c03d4a633ecd6c6a
-plan14-root-reads-rootfs-apps-1-new.tsv 873bb2bce9fee9b41568b75653fb1df749465faf533413e9b0132ab4b80a4df0
-plan14-root-reads-rootfs-apps-1.tsv 225710f8b5e257ff0f72612b44a516dfe9f4bbd3df057e04b637dbd925dc0578
+plan14-root-reads-rootfs-apps-1-new.tsv 975d70da27b01d118dffe4f262f0bdc7904bb6571a079fd9c21bbb319eb06057
+plan14-root-reads-rootfs-apps-1.tsv cad94b3adca26ad5d13a36a21cf54626200aa14ecc83fcc4e835ce2f6b1f3e8f
diff --git a/internal/provision/testdata/plan14-root-reads-rootfs-apps-1-new.tsv b/internal/provision/testdata/plan14-root-reads-rootfs-apps-1-new.tsv
index bb812bb1a..bf15e9184 100644
--- a/internal/provision/testdata/plan14-root-reads-rootfs-apps-1-new.tsv
+++ b/internal/provision/testdata/plan14-root-reads-rootfs-apps-1-new.tsv
@@ -8,16 +8,16 @@
@legacy f1662a273a07f1c63ef82adb6ff0a3208b3d29a6b4562fca5a50f4d4226d5395 internal/release/rootfs_ship.go hashSpooledFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console) and the carlos CLI on a person's machine, as the person, in direct mode (no box unit): new (rootfs Plan 1), reached only from release.ShipSpooled, opens the image file its caller spooled (the console's upload spool or the CLI's own scratch) to hash and size it once before publication; decides nothing for root file:Open@70 89fd0516bddd454293bb0cb78d06f60d969e2d80f74ed422a3f43bd6fd66bf27
@legacy 94e3922bed4b0df1bde55554c09dc9765ee620e1125721673be25f4018646bd8 internal/release/rootfs_ship.go putImmutableFrom legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console) and the carlos CLI on a person's machine, as the person, in direct mode (no box unit): new (rootfs Plan 1), reached only from release.ShipSpooled, opens the same spooled image file to stream it into the release bucket as a create-only put; on a lost race it hashes the existing object, never the box's state; decides nothing for root file:Open@106 a60dc283fe607f89671b55ff706fd3b656b303e356ac0060261c5cdbfd6855c6
@legacy 9173125d07a721094c05ea5eeb9120477ec9f3e123ea2c4dec445877e79ef481 internal/rootfsimage/archive.go OpenArchive legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats and opens the docker save or podman save archive the person named (or the one the CLI exported into its own scratch) and reads its entries in place as sections; nothing is extracted by name; decides nothing for root file:Open@226,file:Stat@73 c19ae55f5619df47cfe2afb53de8e408a173e234b26212c1b0eff3036f1f9397
-@legacy 1e15921d5ec8f9186291e8cdbf144ba8619851e353678340bb74da5de99c5a1a internal/rootfsimage/dir.go readDir legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, walks the directory the person named (EvalSymlinks of that root only, Stat, WalkDir, Readlink of each symlink, never followed); reads names, modes and link targets, the bytes later through Tree.Open; decides nothing for root file:EvalSymlinks@123,file:Readlink@1719,file:Stat@193,file:WalkDir@757 1d982791f1bf96191360b2ef87473ef723d49a2de0be8ae8c84c19c8a831ea91
+@legacy 26ac121616dd25c13fb8968f62c0c3ce0735ae5aa2be7df2ef180227bcd4b95d internal/rootfsimage/dir.go readDir legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, walks the directory the person named (EvalSymlinks of that root only, Stat, WalkDir, Readlink of each symlink, never followed); reads names, modes and link targets, the bytes later through Tree.Open; decides nothing for root file:EvalSymlinks@123,file:Readlink@1719,file:Stat@193,file:WalkDir@757 fb2da477c75a164658c80e06daadcaa0041b1d2d03791bf7404f15c246a63b99
@legacy 4ce9c95915443f2c22c10b77c845a916a8f243ec516701e689a5573022a88cd4 internal/rootfsimage/errors.go CommandError.Error legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the refusal's sentence; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@237 b8d64424f4e118c297fa0982e245c29de171e9aa56287e264bef997f13ad08e4
@legacy 980af1a9be9f489c84b9e5f9a94e36f45498107244ae279179acb33d81e580f1 internal/rootfsimage/errors.go type CommandError legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the refusal's type; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@35 9812608a0a0b885f8fdea0526df6e71896a61a3243be9dd16fac8019f8e6254c
-@legacy 83ceebf009515bf6b0db99cd2c0ca5fcbe5718c002f70322353a03308486b506 internal/rootfsimage/flatten.go boundedReader.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a layer's decompressed stream (from a blob of the person's image) and fails past the image's byte bound; the reader's Read, not a file; decides nothing for root file:Read@205,file:Read@24 8e05e9c4a9914b84fbf9c39662cfb8408b3e83c9537c66fcc697454c8087740c
+@legacy cad0de2fa8dca1e2c35bdf3d04e30027f986f5fffff738454199007fd06bc7fd internal/rootfsimage/flatten.go boundedReader.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a layer's decompressed stream (from a blob of the person's image) and fails past the image's byte bound; the reader's Read, not a file; decides nothing for root file:Read@160,file:Read@24 7d5b4f8bac0a432cbfe1ece92b971aa8ee915be49d4b21475afb29dc0d023499
@legacy 4adcd87a4cf55bcdb2c7fd8b6fbc1d387a8f1e69c98bfca3dce1063ff0bdd4ae internal/rootfsimage/framework.go FillConsole legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, fills in a known framework's console process from the in-memory tree; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@897 94952824384be27a5a8a6a003f48f0afaabd8a57c5b23900391b7aa6cffc728f
@legacy 38687b3a14749ceedc43514d8ba068c240ff5a46f929708434f0890d6729a380 internal/rootfsimage/oci.go OpenLayout legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, opens the OCI layout directory the person named as an os.Root, so no blob or symlink leads out of it; decides nothing for root file:OpenRoot@66 82dd665eb26ac5d8f2c8aef7510b0d80fbc2817d8d63d3c2e3e1e4ee25bfdb35
@legacy 8708098c5a62564e5167d96de9f80738857c2eaf06ec44ce541430e332010ca6 internal/rootfsimage/oci.go layoutStore.has legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats a file of the layout through its os.Root; decides nothing for root file:Stat@57 064049e649e466d9df1e478cd6e55b37f2227522752f864a851e197c2ffde3a5
@legacy 8386a5a0c23c595ce2f016e28ff838f50cba8c3f2e3d1958be614518bff8f720 internal/rootfsimage/oci.go layoutStore.open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats and opens a regular file of the layout through its os.Root, refusing anything else; decides nothing for root file:Open@345,file:Stat@116,file:Stat@449 6dbd8278e86f1c433285c1c0910bfd11b68f9119ff2e346b3f6e425ba99de7e4
@legacy 927c5246cda1b1e5a8af125c5b8389627d3b3dcd73dd688d0ef46ef26f23d0eb internal/rootfsimage/oci.go ociReader.readBlob legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads one blob of the person's image (an index, manifest or config, at most a fixed size), verified against its digest; decides nothing for root file:ReadAll@161 6f20a40de98390d87a7042061ddc00e54779b7044684d3a3b375e8b7b8a202c1
-@legacy 183d5a2b50be88d1ab713c5d74e05798503e80a6e8814efa11e6387c8cdf8e84 internal/rootfsimage/oci.go readFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads index.json or manifest.json of the person's layout or archive, at most maxJSONBytes; decides nothing for root file:ReadAll@279 b98c944496214a92627a79ef98c06d17a008ce17fbfa3356ba68b9c2f515b7b2
+@legacy 2ea8112ef0b8065b221e0c545e81656b06ab84f36da85f48ca67e077ce9e0c87 internal/rootfsimage/oci.go readFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads index.json or manifest.json of the person's layout or archive, at most maxJSONBytes; decides nothing for root file:ReadAll@242 e31050069c07a50df4faf17e527d390a44b57451b3e0ef8a8bd88489daab80b2
@legacy c187fa6fa0464d0739b063159cfdbde65172dc4a859421257d915354d705c0e7 internal/rootfsimage/oci.go verifier.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a blob stream of the person's image and checks its sha256 digest at the end; the reader's Read, not a file; decides nothing for root file:Read@102,file:Read@19 3155388f7ec924e45ef345aaae668c1d4340648c673f1e4c4534597085778103
@legacy d55f2ea60600cd9b7abf644c0c94817ba8cfbab7c6b87eef6ac07aa3a213c80d internal/rootfsimage/processes.go ApplyImageConfig legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, merges the image config's env and working dir into the processes; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@549,file:Command@574 82c5e34d66bc73d613486fc8ab913d50d21246014b42d5ab9d2c2542049d3d66
@legacy eb0946e4251047589ff151c848bd2d6d1fab3bf651436a02cd6fed94941b7723 internal/rootfsimage/processes.go ResolveCommands legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, looks each process's command up in the in-memory tree; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@171,file:Command@230,file:Command@239 eb4611c838927abcee9390eb2088065490ff44a46bbd421ce071b9630f09a8d9
@@ -35,7 +35,7 @@
@legacy 874192cedc6e364d72be6d4b3a49c8c849eb1dde8ae37b49aa5e8ccd941de27d internal/rootfsimage/tar.go Tree.copyFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a regular file of the tree through Tree.Open (the spool under the CLI's own scratch, or the person's directory source) into the tar stream the --check import reads; decides nothing for root file:Open@67 d5284439478bde0664831320693f1cd3f9aa7a97890c32508c9b62f49d0cb531
@legacy 3abc9f24b1bc610c76561df20f9734c826324ca51453552f5e4f1752985ae328 internal/rootfsimage/tree.go Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats the source the person named (and its oci-layout file) to choose a layout, an archive or a directory; decides nothing for root file:Open@5,file:Stat@154,file:Stat@58 ca04f5016aa1e1c185940c7992b1a39cc167bfdae2e89287be87e9c353aa927d
@legacy 349b05675adef44a1a3331d79989fcef013cdf27b25dc3a0c0ac006dc8617599 internal/rootfsimage/tree.go Tree.Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, opens a regular file of the tree: a spool file it wrote under the CLI's own scratch, or a file of the person's directory source; decides nothing for root file:Open@15,file:Open@165 c7d8f05180d3aa358720be290041d77f08bc631dddc46cb3631a437ec86c0e05
-@legacy bf3a0d8bb4e28239911727bfcd1fabbfa8d10817b7d2163902fb6140854ed645 internal/rootfsimage/tree.go Tree.writeBlob legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, creates a spool file (O_EXCL, 0600, named by a counter, never by the image) under the tree's spool in the CLI's own scratch (writes, does not read); decides nothing for root file:OpenFile@285 56305d3166cf57a6397f4ec591dbf8596dbf8bd19d8be11a4417fee5ce10ac8c
+@legacy 83559b0e34e8fb350aa97fb7bb77674b587eb72a29187b7673d310b2e72412b7 internal/rootfsimage/tree.go Tree.writeBlob legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, creates a spool file (O_EXCL, 0600, named by a counter, never by the image) under the tree's spool in the CLI's own scratch (writes, does not read); decides nothing for root file:OpenFile@249 5ae91de79c050ab1be920de4e1cae3487f3bd933f61bee9841bc280b3762fdb6
@legacy 1b8938c8d50e48ad187a7acde871b20cfda3b9af9dd3cec276dc5b76a51b679c ship_check.go const#2 legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), the paths a box gives an instance (/data/instances/check, /run/carlos/instances/check, the socket and the db) as they appear inside the --check container, on volumes the check made; the host's /data is never named or read; decides nothing for root data-literal@24 74baca97cbc13497d790d98c2ed43ce2123c27ccd9c40d6fc98b857d155aceb8
@legacy 3a80febe2bc13dceef326bb1f3a71e91a738b8903fa172ac98dcb85302552631 ship_check.go rootfsCheck.runArgs legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), builds the docker or podman run argv for one check container; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@770,file:Command@854 b21dca7ccd34f38f969f891ea6615f1f4c0057b342ecb44b2a2b2214cb9f46e4
@legacy 355e3ead803016c7080595fccdeee34cc16e4764f1a3e8737d66a27e4b452337 ship_check.go runRootfsCheck legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), the scanner matches crypto/rand.Read (four random bytes naming the check's containers and volumes); reads no file; decides nothing for root file:Read@143 e3b27e7e63eb6c6ccb38515261589a5f4dcb2f9cae2290db018d9b3bc66268b1
@@ -57,16 +57,16 @@ internal/release/rootfs.go validateProcess legacy accepted-legacy accepted-legac
internal/release/rootfs_ship.go hashSpooledFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console) and the carlos CLI on a person's machine, as the person, in direct mode (no box unit): new (rootfs Plan 1), reached only from release.ShipSpooled, opens the image file its caller spooled (the console's upload spool or the CLI's own scratch) to hash and size it once before publication; decides nothing for root file:Open@70 89fd0516bddd454293bb0cb78d06f60d969e2d80f74ed422a3f43bd6fd66bf27
internal/release/rootfs_ship.go putImmutableFrom legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console) and the carlos CLI on a person's machine, as the person, in direct mode (no box unit): new (rootfs Plan 1), reached only from release.ShipSpooled, opens the same spooled image file to stream it into the release bucket as a create-only put; on a lost race it hashes the existing object, never the box's state; decides nothing for root file:Open@106 a60dc283fe607f89671b55ff706fd3b656b303e356ac0060261c5cdbfd6855c6
internal/rootfsimage/archive.go OpenArchive legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats and opens the docker save or podman save archive the person named (or the one the CLI exported into its own scratch) and reads its entries in place as sections; nothing is extracted by name; decides nothing for root file:Open@226,file:Stat@73 c19ae55f5619df47cfe2afb53de8e408a173e234b26212c1b0eff3036f1f9397
-internal/rootfsimage/dir.go readDir legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, walks the directory the person named (EvalSymlinks of that root only, Stat, WalkDir, Readlink of each symlink, never followed); reads names, modes and link targets, the bytes later through Tree.Open; decides nothing for root file:EvalSymlinks@123,file:Readlink@1719,file:Stat@193,file:WalkDir@757 1d982791f1bf96191360b2ef87473ef723d49a2de0be8ae8c84c19c8a831ea91
+internal/rootfsimage/dir.go readDir legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, walks the directory the person named (EvalSymlinks of that root only, Stat, WalkDir, Readlink of each symlink, never followed); reads names, modes and link targets, the bytes later through Tree.Open; decides nothing for root file:EvalSymlinks@123,file:Readlink@1719,file:Stat@193,file:WalkDir@757 fb2da477c75a164658c80e06daadcaa0041b1d2d03791bf7404f15c246a63b99
internal/rootfsimage/errors.go CommandError.Error legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the refusal's sentence; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@237 b8d64424f4e118c297fa0982e245c29de171e9aa56287e264bef997f13ad08e4
internal/rootfsimage/errors.go type CommandError legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, the refusal's type; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@35 9812608a0a0b885f8fdea0526df6e71896a61a3243be9dd16fac8019f8e6254c
-internal/rootfsimage/flatten.go boundedReader.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a layer's decompressed stream (from a blob of the person's image) and fails past the image's byte bound; the reader's Read, not a file; decides nothing for root file:Read@205,file:Read@24 8e05e9c4a9914b84fbf9c39662cfb8408b3e83c9537c66fcc697454c8087740c
+internal/rootfsimage/flatten.go boundedReader.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a layer's decompressed stream (from a blob of the person's image) and fails past the image's byte bound; the reader's Read, not a file; decides nothing for root file:Read@160,file:Read@24 7d5b4f8bac0a432cbfe1ece92b971aa8ee915be49d4b21475afb29dc0d023499
internal/rootfsimage/framework.go FillConsole legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, fills in a known framework's console process from the in-memory tree; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@897 94952824384be27a5a8a6a003f48f0afaabd8a57c5b23900391b7aa6cffc728f
internal/rootfsimage/oci.go OpenLayout legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, opens the OCI layout directory the person named as an os.Root, so no blob or symlink leads out of it; decides nothing for root file:OpenRoot@66 82dd665eb26ac5d8f2c8aef7510b0d80fbc2817d8d63d3c2e3e1e4ee25bfdb35
internal/rootfsimage/oci.go layoutStore.has legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats a file of the layout through its os.Root; decides nothing for root file:Stat@57 064049e649e466d9df1e478cd6e55b37f2227522752f864a851e197c2ffde3a5
internal/rootfsimage/oci.go layoutStore.open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats and opens a regular file of the layout through its os.Root, refusing anything else; decides nothing for root file:Open@345,file:Stat@116,file:Stat@449 6dbd8278e86f1c433285c1c0910bfd11b68f9119ff2e346b3f6e425ba99de7e4
internal/rootfsimage/oci.go ociReader.readBlob legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads one blob of the person's image (an index, manifest or config, at most a fixed size), verified against its digest; decides nothing for root file:ReadAll@161 6f20a40de98390d87a7042061ddc00e54779b7044684d3a3b375e8b7b8a202c1
-internal/rootfsimage/oci.go readFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads index.json or manifest.json of the person's layout or archive, at most maxJSONBytes; decides nothing for root file:ReadAll@279 b98c944496214a92627a79ef98c06d17a008ce17fbfa3356ba68b9c2f515b7b2
+internal/rootfsimage/oci.go readFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads index.json or manifest.json of the person's layout or archive, at most maxJSONBytes; decides nothing for root file:ReadAll@242 e31050069c07a50df4faf17e527d390a44b57451b3e0ef8a8bd88489daab80b2
internal/rootfsimage/oci.go verifier.Read legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a blob stream of the person's image and checks its sha256 digest at the end; the reader's Read, not a file; decides nothing for root file:Read@102,file:Read@19 3155388f7ec924e45ef345aaae668c1d4340648c673f1e4c4534597085778103
internal/rootfsimage/processes.go ApplyImageConfig legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, merges the image config's env and working dir into the processes; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@549,file:Command@574 82c5e34d66bc73d613486fc8ab913d50d21246014b42d5ab9d2c2542049d3d66
internal/rootfsimage/processes.go ResolveCommands legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, looks each process's command up in the in-memory tree; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@171,file:Command@230,file:Command@239 eb4611c838927abcee9390eb2088065490ff44a46bbd421ce071b9630f09a8d9
@@ -84,7 +84,7 @@ internal/rootfsimage/squashfs.go writeSquashfs legacy accepted-legacy accepted-l
internal/rootfsimage/tar.go Tree.copyFile legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, reads a regular file of the tree through Tree.Open (the spool under the CLI's own scratch, or the person's directory source) into the tar stream the --check import reads; decides nothing for root file:Open@67 d5284439478bde0664831320693f1cd3f9aa7a97890c32508c9b62f49d0cb531
internal/rootfsimage/tree.go Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, stats the source the person named (and its oci-layout file) to choose a layout, an archive or a directory; decides nothing for root file:Open@5,file:Stat@154,file:Stat@58 ca04f5016aa1e1c185940c7992b1a39cc167bfdae2e89287be87e9c353aa927d
internal/rootfsimage/tree.go Tree.Open legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, opens a regular file of the tree: a spool file it wrote under the CLI's own scratch, or a file of the person's directory source; decides nothing for root file:Open@15,file:Open@165 c7d8f05180d3aa358720be290041d77f08bc631dddc46cb3631a437ec86c0e05
-internal/rootfsimage/tree.go Tree.writeBlob legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, creates a spool file (O_EXCL, 0600, named by a counter, never by the image) under the tree's spool in the CLI's own scratch (writes, does not read); decides nothing for root file:OpenFile@285 56305d3166cf57a6397f4ec591dbf8596dbf8bd19d8be11a4417fee5ce10ac8c
+internal/rootfsimage/tree.go Tree.writeBlob legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), internal/rootfsimage, imported only by the root package's carlos ship --rootfs and --check files, creates a spool file (O_EXCL, 0600, named by a counter, never by the image) under the tree's spool in the CLI's own scratch (writes, does not read); decides nothing for root file:OpenFile@249 5ae91de79c050ab1be920de4e1cae3487f3bd933f61bee9841bc280b3762fdb6
ship_check.go const#2 legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), the paths a box gives an instance (/data/instances/check, /run/carlos/instances/check, the socket and the db) as they appear inside the --check container, on volumes the check made; the host's /data is never named or read; decides nothing for root data-literal@24 74baca97cbc13497d790d98c2ed43ce2123c27ccd9c40d6fc98b857d155aceb8
ship_check.go rootfsCheck.runArgs legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), builds the docker or podman run argv for one check container; the scanner matches the word Command, here a field of release.Process (a process's argv), not os/exec; reads no file; decides nothing for root file:Command@770,file:Command@854 b21dca7ccd34f38f969f891ea6615f1f4c0057b342ecb44b2a2b2214cb9f46e4
ship_check.go runRootfsCheck legacy accepted-legacy accepted-legacy;rev3=census-ruling-rootfs-apps-1;basis=root-input (J4, as main's db.go units); the carlos CLI on a person's machine, as the person (no box unit): new (rootfs Plan 1), the scanner matches crypto/rand.Read (four random bytes naming the check's containers and volumes); reads no file; decides nothing for root file:Read@143 e3b27e7e63eb6c6ccb38515261589a5f4dcb2f9cae2290db018d9b3bc66268b1
diff --git a/internal/provision/testdata/plan14-root-reads-rootfs-apps-1.tsv b/internal/provision/testdata/plan14-root-reads-rootfs-apps-1.tsv
index 8ebffeb9f..665141c5c 100644
--- a/internal/provision/testdata/plan14-root-reads-rootfs-apps-1.tsv
+++ b/internal/provision/testdata/plan14-root-reads-rootfs-apps-1.tsv
@@ -4,14 +4,14 @@
@legacy ee300133781b7f0e96187f4791e258df4ba7dc3d8e403c5bbc1325e0413a2aea internal/console/apicli.go Server.handleAPIShip legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=census-ruling-rootfs-apps-1;basis=rootfs Plan 1 Task 8: takes kind rootfs (meta via shipMeta, the body bound lowered once the kind is known through shipBody), refuses a release of the wrong kind or hibernation before any part is read (release.CheckShipKind), hands a rootfs body to shipRootfsParts and gives its ship slot back once that holds its scratch; a kind refused at publication answers as at the door; refusal sentences named as constants; the same read, no read added file:ReadAll@11932 2fbe1f40880a35a486b21542afce6e40db56f1df260f5fac57a7bd0e15496d7b
@legacy 7ec6d86d921e65ea491d2b9aaf36a996abca524daefacb107cab07939c8e5174 internal/hostops/mutation_boundary_putfrom.go conditionalRecordStore.PutFrom legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=census-ruling-rootfs-apps-1;basis=rootfs Plan 1 Task 3: the same rootfs image key streams past the record checks beside the GeoIP blob key (a rootfs image is never a record body); the same read, no read added file:ReadAll@397 50fef94769c4e4d4c49d72c657ff96b0d49a8fd5f03bca4cedce19f6e5fd0067
@legacy fc4325af9d68b2b10fecde21cdcaafdb9b6e4abbd688f321e5a1c59b9b9db4ec internal/hostops/mutation_boundary_putfrom.go mutationBoundary.PutFrom legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=census-ruling-rootfs-apps-1;basis=rootfs Plan 1 Task 3: a create-only put of an exact release rootfs image key (release.IsRootfsArtifactKey) now streams to the raw store after the boundary decides it, bounded by release.MaxRootfsBytes (streamLimit), as a GeoIP blob already did; the same read, no read added file:ReadAll@311 e04f3976e679699e57cb69b4ada1e3af92cdd7ed99ee7a52b0c12252b4473866
-@legacy fecf7d311f638cf2a4eddafd17dd32213692986d03269ec5c90f137340779afa cli.go runShip legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=census-ruling-rootfs-apps-1;basis=rootfs Plan 1 Task 9: takes --rootfs, --processes, --hibernate, --jit and --check and hands a rootfs ship to runShipRootfs (ship_rootfs.go) before the binary path; the --notes-file ReadFile moved into shipNoteText (its own row, the same read of the file the person named) and the direct-mode version mint into mintDirectVersion; one read site fewer, none added file:ReadFile@7227,file:ReadFile@7451 4a3c3140be83b5ab36f44b7fbfe78c67b4a10bab435b9196a721712c5047f241
+@legacy dd8ce18985f7b511d8d0b17f1d0b63ef22691d2337b6869ff1aa69d69616242c cli.go runShip legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=census-ruling-rootfs-apps-1;basis=rootfs Plan 1 Task 9: takes --rootfs, --processes, --hibernate, --jit and --check and hands a rootfs ship to runShipRootfs (ship_rootfs.go) before the binary path; the --notes-file ReadFile moved into shipNoteText (its own row, the same read of the file the person named) and the direct-mode version mint into mintDirectVersion; one read site fewer, none added; Task 12: the --hibernate flag help is RFS-1-C32's new text, the same reads file:ReadFile@7227,file:ReadFile@7451 f7b50de3151fc59358374d5650ffdea41886d4694c27775ecec2f9f999794175
cli.go runShipAPI legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=census-ruling-rootfs-apps-1;basis=rootfs Plan 1 Task 9: the success lines moved into printAPIShipped, which ship_rootfs.go shares; the same result returned; no read added file:CreateTemp@522,file:Stat@1958 01af3c42c7f108f37abc402aec11bf035a544a73b2e14796a29f97bcf4b2979f
internal/console/apicli.go Server.handleAPIShip legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=census-ruling-rootfs-apps-1;basis=rootfs Plan 1 Task 8: takes kind rootfs (meta via shipMeta, the body bound lowered once the kind is known through shipBody), refuses a release of the wrong kind or hibernation before any part is read (release.CheckShipKind), hands a rootfs body to shipRootfsParts and gives its ship slot back once that holds its scratch; a kind refused at publication answers as at the door; refusal sentences named as constants; the same read, no read added file:ReadAll@11932 2fbe1f40880a35a486b21542afce6e40db56f1df260f5fac57a7bd0e15496d7b
internal/hostops/mutation_boundary_putfrom.go conditionalRecordStore.PutFrom legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=census-ruling-rootfs-apps-1;basis=rootfs Plan 1 Task 3: the same rootfs image key streams past the record checks beside the GeoIP blob key (a rootfs image is never a record body); the same read, no read added file:ReadAll@397 50fef94769c4e4d4c49d72c657ff96b0d49a8fd5f03bca4cedce19f6e5fd0067
internal/hostops/mutation_boundary_putfrom.go mutationBoundary.PutFrom legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=census-ruling-rootfs-apps-1;basis=rootfs Plan 1 Task 3: a create-only put of an exact release rootfs image key (release.IsRootfsArtifactKey) now streams to the raw store after the boundary decides it, bounded by release.MaxRootfsBytes (streamLimit), as a GeoIP blob already did; the same read, no read added file:ReadAll@311 e04f3976e679699e57cb69b4ada1e3af92cdd7ed99ee7a52b0c12252b4473866
-cli.go runShip legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=census-ruling-rootfs-apps-1;basis=rootfs Plan 1 Task 9: takes --rootfs, --processes, --hibernate, --jit and --check and hands a rootfs ship to runShipRootfs (ship_rootfs.go) before the binary path; the --notes-file ReadFile moved into shipNoteText (its own row, the same read of the file the person named) and the direct-mode version mint into mintDirectVersion; one read site fewer, none added file:ReadFile@7227,file:ReadFile@7451 4a3c3140be83b5ab36f44b7fbfe78c67b4a10bab435b9196a721712c5047f241
-@coverage . 901f60039e4b3e376e411af65e1fdd1a539e886ee11ea7a961b43b3a3a86cb94
+cli.go runShip legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=census-ruling-rootfs-apps-1;basis=rootfs Plan 1 Task 9: takes --rootfs, --processes, --hibernate, --jit and --check and hands a rootfs ship to runShipRootfs (ship_rootfs.go) before the binary path; the --notes-file ReadFile moved into shipNoteText (its own row, the same read of the file the person named) and the direct-mode version mint into mintDirectVersion; one read site fewer, none added; Task 12: the --hibernate flag help is RFS-1-C32's new text, the same reads file:ReadFile@7227,file:ReadFile@7451 f7b50de3151fc59358374d5650ffdea41886d4694c27775ecec2f9f999794175
+@coverage . 8347d3906c879403cd0edf0c11a8d55f8ab00defe9653a2a1ac9652c8c43c724
@coverage internal/console 80060e0ef5d5b285df970abc6d5a080bdc6249599f4842d3a00e8e456f60410e
@coverage internal/hostops 075130a7118bd616dda1b37cf4769837a60af677e645ba0b2fe7d2b995940efb
@coverage internal/release 99a17e1ad7dd5089bb73f97a43b714303c80c374efba17131f7c6684abec6df0
-@coverage internal/rootfsimage 9091abc01b3ebe57306fb0c4489d0cea972c0aec9298e35f9f219eda17cb8812
+@coverage internal/rootfsimage 899af5165cb3b4f15b1bf000d6a744e0b8623a4eeba0502b96b500d62a0c95c3