amadan
Readiness, handoff and outstanding at 06:28: the replicator's authority design written and under review
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
3 files changed,
+4
−3
.claude/HANDOFF.md+2 −2implementation/carloku-paid-launch/OUTSTANDING.md+1 −1implementation/carloku-paid-launch/READINESS.md+1 −0
CI passed — run details
diff --git a/.claude/HANDOFF.md b/.claude/HANDOFF.md| index 92d25644e..ebefddced 100644 |
| --- a/.claude/HANDOFF.md |
| +++ b/.claude/HANDOFF.md |
| @@ -7,7 +7,7 @@ |
| Get Carloku's paid plans live with Stripe Tax and the complete metered model; have the pricing page and signup flow reviewable in the morning. |
| **STATUS:** |
| -Written 06:22 Dublin on 2026-10-03 (resumed 21:40 on 2026-10-02 after a provider limit; nothing was lost), during the second overnight run (brief: "continue overnight until we're ready to enable payments"; ready means reviewed, tested, integrated code and a scoped enablement plan, not payments switched on). Billing is OFF everywhere. No live Stripe write, no AWS change, no charge, no merge to main. **At 01:55 the currency branch (the price book and the retirement protocol) merged into this branch at `d64180a7`, after its twenty-sixth and twenty-seventh reviews ended with both reviewers accepting; the AWS principal report merged at `c4ee8807` after its seventh; the operator CLI at `1cd5a0d8`; per-line tax codes (OUTSTANDING item 17, built behind its hold, decision 16 untouched) at `e2adf26f` after three code reviews.** The merged tip `7399d9fe` passed its gate (exit 0, three cross builds) and CI. Every payment anyone can see is a labelled simulation. |
| +Written 06:28 Dublin on 2026-10-03 (resumed 21:40 on 2026-10-02 after a provider limit; nothing was lost), during the second overnight run (brief: "continue overnight until we're ready to enable payments"; ready means reviewed, tested, integrated code and a scoped enablement plan, not payments switched on). Billing is OFF everywhere. No live Stripe write, no AWS change, no charge, no merge to main. **At 01:55 the currency branch (the price book and the retirement protocol) merged into this branch at `d64180a7`, after its twenty-sixth and twenty-seventh reviews ended with both reviewers accepting; the AWS principal report merged at `c4ee8807` after its seventh; the operator CLI at `1cd5a0d8`; per-line tax codes (OUTSTANDING item 17, built behind its hold, decision 16 untouched) at `e2adf26f` after three code reviews.** The merged tip `7399d9fe` passed its gate (exit 0, three cross builds) and CI. Every payment anyone can see is a labelled simulation. |
| Review servers, all answering 200: pricing page `http://100.119.180.57:38009` (static, rebuilt from site `2fc6388`), signup and billing demo `http://100.119.180.57:41881` (**rebuilt at 02:10 from the integrated launch branch, `404e699f`, whose code is `7399d9fe`: the currency branch and the AWS principal report merged, gate and CI passed**; it runs until about 17:10 Dublin, restart recipe in `layout-review/STATE-demo.txt`; a labelled simulation, not Stripe proof: Keymail and Stripe simulated on the same listener; the `68f6ee23` build served until 02:06), console billing copy `http://100.119.180.57:45033` if still up. |
| @@ -45,6 +45,6 @@ Branches (all on the forge, none merged; the local gate is not CI): |
| - Then, each on its own branch: quantity reduction at renewal, the evidence door for a box's first minutes, the AWS principal inventory and the bucket ownership attestation door, Free-tier enforcement, dormancy and pool accounting. |
| **SESSION:** |
| -Nothing running at 06:22. The gate and CI passed on this branch's tip `8777d28e` (the per-line tax codes merge plus Task 5's records). Done tonight: the currency branch (`d64180a7`), the AWS principal report (`c4ee8807`), the operator CLI (`1cd5a0d8`) and per-line tax codes (`e2adf26f`) merged, each after its reviews, its gate alone and CI; `29ea6676` gate and CI passed. Next: the build list below; the approvals and decisions 1 to 16 are Paul's. Next: item 17's design (per-line tax codes; the mechanics that need no decision) on its own branch with an Astra design review; the rest of the build list. Done: the gates on `2b0abef1` (00:51Z), `0491ff76` (00:46Z), `9b872e38` (00:42Z), `4a1a92d9` (00:36Z). Then: the build list below, each on its own branch. Full package runs need `GOFLAGS=-buildvcs=false`, as the gate sets it. Detached `setsid` processes. A gate must be started with `logs/run-gate.sh`, which uses the default build cache; full runs take the gate's `-timeout 30m`. |
| +Running at 06:28: Astra's design review of the replicator's authority design (`design-replicator-pinned-root` `afd4dde0`: pinned roots, litestream beneath them, holds that survive exit, claims by identity; decisions 10-13 and approval H as parameters). Done: the gate and CI on this branch's tip `8777d28e`. Next: revise the design, then its parameter-independent tasks on that branch. Done tonight: the currency branch (`d64180a7`), the AWS principal report (`c4ee8807`), the operator CLI (`1cd5a0d8`) and per-line tax codes (`e2adf26f`) merged, each after its reviews, its gate alone and CI; `29ea6676` gate and CI passed. Next: the build list below; the approvals and decisions 1 to 16 are Paul's. Next: item 17's design (per-line tax codes; the mechanics that need no decision) on its own branch with an Astra design review; the rest of the build list. Done: the gates on `2b0abef1` (00:51Z), `0491ff76` (00:46Z), `9b872e38` (00:42Z), `4a1a92d9` (00:36Z). Then: the build list below, each on its own branch. Full package runs need `GOFLAGS=-buildvcs=false`, as the gate sets it. Detached `setsid` processes. A gate must be started with `logs/run-gate.sh`, which uses the default build cache; full runs take the gate's `-timeout 30m`. |
| Scratch on the box: `~/.cache/tmp/claude-1001/{currency-wt,replicator-wt,fencing-wt,evidence-wt,opcli-wt,inventory-wt,flush-wt,reduction-wt}` (git worktrees), the demo binaries, `/var/tmp/ck`, `~/.cache/carloku-gate`. The void gate logs are named `*VOID*`. |
diff --git a/implementation/carloku-paid-launch/OUTSTANDING.md b/implementation/carloku-paid-launch/OUTSTANDING.md| index 47129c781..e9cd8f330 100644 |
| --- a/implementation/carloku-paid-launch/OUTSTANDING.md |
| +++ b/implementation/carloku-paid-launch/OUTSTANDING.md |
| @@ -32,7 +32,7 @@ Each is concrete. None is waived. |
| ### Meters (the complete metered model cannot invoice until both are proven) |
| -1. **Replication writes (`durability_writes_1k`) cannot be proven on any box.** The external replicator writes outside the ledger. Path A (scoped attestation) was built, reviewed in round six, and cannot prove an exclusive writer; it is off this branch and parked on `feat/carloku-scoped-attestation-20261001`. Path B (the platform's own replicator as the only writer) is **partial, unwired, and has not had a whole-branch pass from both reviewers** (nineteen builds; Opus rejected the first, second and eighth and accepts the rest with fixes, Astra rejects each on the deep items), on `feat/carloku-metered-replicator-20261001` (the forge has the tip; `READINESS.md` names it with its gate and CI state). What is built there: a request gate in `internal/lease` that stops an attempt before it is sent; an ownership generation in the registry moved by the six route columns the replicator reads (not by its own bookkeeping writes); a fleet that holds every recorder's days in doubt and watches without a request; one strict inventory with file checks (one name, ordinary siblings, a link named with its target as written and classified by that spelling through a directory-only descriptor, no crossing onto another filesystem (a same-filesystem bind alias is not detected), the chain root's owner, under a platform directory) and a second look on a timer; and shadow state made private before litestream can make it. Still open there, each named in its dispositions as blocking wiring: litestream's own opens by path after a look (needs litestream to open beneath a pinned root), replaceable ancestry above a protected directory, an admitted request delayed past the margin, a process dying between a change and the rebuild (the doubt is in memory only), device effects through an ancestor swap, hibernating aliases and claims on skipped files, required coverage that disappears without an entry, that any tenant can stop a rebuild for the box, route identity unbound to filesystem authority, and the uid binding under approval H. `DISPOSITIONS-metered-replicator.md` on that branch has every finding and what each build did about it. What is there: a litestream store whose every replica client is metered with no unmetered fallback, an owner for each database the box replicates, and a fleet store that refuses anything it cannot meter, each with tests. **Absent**: the agent wiring that binds those meters to the box's ledger, a restore path that does not shell out to the external binary, the unit change, moving the replica credentials so nothing else on the box holds them (the unit runs as the same user as the agent today), and any attestation. Until all of that exists and is approved for a box, this meter is incomplete every month and nothing is invoiced. Scoped 2026-10-03 06:20 for the next design, not built: the replicator's eleven deferred items (dispositions of review twenty) need one design before any wiring, in three parts: the replicator's own opens beneath a root pinned at admission (`os.Root` on Go 1.26 resolves beneath a directory descriptor and refuses a link out; the header read, the listing and the link reads go through it, with the manual `openat` walk in `internal/privatefile` as the shape on a kernel where `openat2` is blocked); the vendored litestream's opens beneath the same root (its database and WAL opens are by path through the sqlite driver, which takes no descriptor; the candidates are a fork taking an `*os.Root` for its own files and a descriptor-derived path for the connection, each with a stated cost); and durable transition state across a crash or restart (an admitted request's deadline and the uncertainty after exit, journaled). The box-wide refusal (decision) and approval H stay separate. |
| +1. **Replication writes (`durability_writes_1k`) cannot be proven on any box.** The external replicator writes outside the ledger. Path A (scoped attestation) was built, reviewed in round six, and cannot prove an exclusive writer; it is off this branch and parked on `feat/carloku-scoped-attestation-20261001`. Path B (the platform's own replicator as the only writer) is **partial, unwired, and has not had a whole-branch pass from both reviewers** (nineteen builds; Opus rejected the first, second and eighth and accepts the rest with fixes, Astra rejects each on the deep items), on `feat/carloku-metered-replicator-20261001` (the forge has the tip; `READINESS.md` names it with its gate and CI state). What is built there: a request gate in `internal/lease` that stops an attempt before it is sent; an ownership generation in the registry moved by the six route columns the replicator reads (not by its own bookkeeping writes); a fleet that holds every recorder's days in doubt and watches without a request; one strict inventory with file checks (one name, ordinary siblings, a link named with its target as written and classified by that spelling through a directory-only descriptor, no crossing onto another filesystem (a same-filesystem bind alias is not detected), the chain root's owner, under a platform directory) and a second look on a timer; and shadow state made private before litestream can make it. Still open there, each named in its dispositions as blocking wiring: litestream's own opens by path after a look (needs litestream to open beneath a pinned root), replaceable ancestry above a protected directory, an admitted request delayed past the margin, a process dying between a change and the rebuild (the doubt is in memory only), device effects through an ancestor swap, hibernating aliases and claims on skipped files, required coverage that disappears without an entry, that any tenant can stop a rebuild for the box, route identity unbound to filesystem authority, and the uid binding under approval H. `DISPOSITIONS-metered-replicator.md` on that branch has every finding and what each build did about it. What is there: a litestream store whose every replica client is metered with no unmetered fallback, an owner for each database the box replicates, and a fleet store that refuses anything it cannot meter, each with tests. **Absent**: the agent wiring that binds those meters to the box's ledger, a restore path that does not shell out to the external binary, the unit change, moving the replica credentials so nothing else on the box holds them (the unit runs as the same user as the agent today), and any attestation. Until all of that exists and is approved for a box, this meter is incomplete every month and nothing is invoiced. Designed 2026-10-03 06:26 (`design-replicator-pinned-root` `afd4dde0`, `docs/superpowers/specs/2026-10-03-replicator-pinned-roots-design.md`, under Astra review; nothing built): the replicator's eleven deferred items (dispositions of review twenty) need one design before any wiring, in three parts: the replicator's own opens beneath a root pinned at admission (`os.Root` on Go 1.26 resolves beneath a directory descriptor and refuses a link out; the header read, the listing and the link reads go through it, with the manual `openat` walk in `internal/privatefile` as the shape on a kernel where `openat2` is blocked); the vendored litestream's opens beneath the same root (its database and WAL opens are by path through the sqlite driver, which takes no descriptor; the candidates are a fork taking an `*os.Root` for its own files and a descriptor-derived path for the connection, each with a stated cost); and durable transition state across a crash or restart (an admitted request's deadline and the uncertainty after exit, journaled). The box-wide refusal (decision) and approval H stay separate. |
| 2. **Store transfer (`store_egress_gb`) has no source.** No Cost and Usage Report export exists on the account. It needs the scoped infrastructure approval, a first real delivery, a basis for the ledger's completeness claim on AWS that no listing can give (decision 14 and proposals A and B in `docs/superpowers/plans/2026-10-02-aws-principal-inventory.md`: a rule the account enforces and a bucket whose creation is provably the grant's own, neither designed; the attestation plan's IAM-read proof is superseded), and the resource side of stores that already exist (bucket policy, ACL, access points; not built). The principal report on `feat/carloku-principal-inventory-20261002` is **a report for a person, not the proof**, in its fifth review; never run against AWS. |
| 3. **A store's partial first hour** with a charged line holds the month, and nothing releases it. It holds by default and nobody is asked to waive it. What can release it is evidence: an operator door that records, for one bucket-hour, who is shown to have owned it and on what evidence, which the fold then honours. **Partial, unwired into this branch**, on `feat/carloku-bucket-hour-evidence-20261001` (`0aa1fbec`, rebased onto this branch): the record, the fold change and three operator API doors, with tests and mutation checks. It accepts only the hour a complete ledger began vouching in and only the owner that ledger names. The full local gate passes on it. First review: Astra rejected it, Opus accepted with fixes. Both confirmed that through the fold it releases nothing but that hour for that owner. Both also found that the evidence is free text that the same operator records and that stands at once, which in practice is a waiver: what counts as evidence, and whether a second person must approve it, needs Paul's ruling (approval J) before more is built. Nothing fixed yet (`DISPOSITIONS-bucket-hour-evidence.md` on that branch). No CI run, no CLI verb, and its operator-facing sentences are unreviewed. |
| 4. **A box's first minutes** before its ledger opened hold that day for everyone. Same as item 3: it holds by default, and the release is an operator evidence door, not a waiver. **Absent**. |
diff --git a/implementation/carloku-paid-launch/READINESS.md b/implementation/carloku-paid-launch/READINESS.md| index 6ed6a63c5..5affb1282 100644 |
| --- a/implementation/carloku-paid-launch/READINESS.md |
| +++ b/implementation/carloku-paid-launch/READINESS.md |
| @@ -25,6 +25,7 @@ Log files are under `/home/paulca/.local/share/carloku-paid-launch-20260930/logs |
| | `feat/carloku-billing-operator-cli-20261002` | `fc7daebd` (a merge of the currency tip `2b0abef1`); before it `6d4c2912` (the fourth review's P3s answered: `account_deleted` always on the wire and printed; the console's own 5xx on a write; the moved console after the offer; the help's two facts); before it `4e9cac43` (`f9683fbe`: the third review's twelve P3s answered: a write names its console or is refused; refusals from in front of the console; the moved console through the interactive offer; the whole command tested through `runBillingWith`; then the currency tip `e152df30` merged in); before it `31731fdd` (Astra's second review answered in `f155e543`: ambiguous flag values refused, the keep wording, strict listing envelopes, write advice that fits the write, the console's note predicate, `billingRun` tested; then the currency tip `05ccec07` merged in); before it `51ef27ac` (the first review answered in `57f70c16`, then the currency tip `b260ac8e` merged in): `carlos billing reviews\|resolve\|rejected\|house`, a client for the four operator doors | `fc7daebd`: **passed** (01:04Z, `gate-opcli-fc7daebd.txt`, exit 0, three cross builds, alone). `40ea61b1`: **passed** (00:08Z, `gate-opcli-40ea61b1.txt`, exit 0, three cross builds, alone). `6d4c2912` was not gated on its own (superseded by the merge). `4e9cac43`: **passed** (23:09Z, `gate-opcli-4e9cac43.txt`, exit 0, three cross builds, alone). `51ef27ac`: **passed** (21:29Z, exit 0, three cross builds); `31731fdd`: **passed** (22:16Z, `gate-opcli-31731fdd.txt`, exit 0, three cross builds). `0f507bff` **failed** (exit 2, `gate-opcli-0f507bff.txt`): one test, the docs gate, which requires a `carlos billing` heading in the public CLI reference. `51ef27ac`: started 21:18Z, run alone (`gate-opcli-51ef27ac.txt`) | passed on `6d4c2912`, `40ea61b1` and `fc7daebd`; `0f507bff` failed (the docs gate) | 4 at `4e9cac43`: **both accept with fixes, all P3**, answered in `6d4c2912` (CI passed); no fifth review unless the client changes. 3 at `31731fdd`: **both accept with fixes** (six P3 each), answered in `f9683fbe`; a fourth reading not started. 2 at `51ef27ac`: Astra accept with fixes (three P2, six P3), answered in `f155e543`; Opus's second reading and Astra's third running on `31731fdd`. 1 at `0f507bff`: Opus accept with fixes (P1 the docs gate, four P2), Astra reject (five P2). Answered in `57f70c16`: arguments are one unambiguous request or refused before anything is sent; writes are reported only on the door's acknowledgement and name the console; one wire-contract file both sides' tests read. Second review not started | **merged into this branch at `1cd5a0d8` (02:12, a merge commit) after the gate and CI on `fc7daebd`; its `docs/site/cli.md` section is unreviewed public copy and must be read before anything publishes the site's CLI page (merging publishes nothing)**; before: not merged (it is built on the currency branch, which merges first). **Its `docs/site/cli.md` section is new public copy and is unreviewed**: it does not merge before Paul reads it |
| | `feat/carloku-principal-inventory-20261002` | `4a1a92d9` (the sixth review answered: an S3 action on an Object Lambda resource is a possible reach, the "possibly" label and the legend extended, the mutation paragraph as the logs have it); before it `36e5ff2d` (the fifth review answered: the possible reach decided by one text test on the pattern and its padded form, decision 14 names what the host role can mint through a store user, the legend's other spellings, a nil page an error); before it `403384c2` (the fourth review answered: a resource pattern read as text and, when it is an incomplete ARN, as padded fields too, a reach under either reported; nothing S3 names excluded, Storage Lens included; an empty condition, an operator with no key and an empty value list are errors; the `AssumableBy` legend and the "does not read" lists reworded for same-account trust, control of compute and IAM writes; counts tagged; the CUR plan and OUTSTANDING item 2 no longer name an inventory in the provisioner as the mechanism); before it `434cdf48` (the third review answered: every S3 resource that is not the bucket a possible reach; incomplete ARNs as IAM reads them; version ids unique; condition values checked; a group's possible reach carried to its members; the label renamed `named_by_deployment`; the attestation plan marked superseded in part); before it `0e1bc298` (the second review answered: a repeated JSON member is an error; a managed policy's default-version id must agree with the version marked default; every trust-policy statement read in full; a grant on an access point, a multi-region access point or an Object Lambda access point reported as a possible reach, marked; the two proposals stated with what they lack); before it `199a9736`: **a report for a person** (`PrincipalReport.BucketPrincipals`: who reaches a name, through which policies, and who each role's trust policy lets assume it), **not a `GranteeProber`** and a test says so; before it `d61f4f27`, which offered itself as the ledger's proof | `4a1a92d9`: **passed** (00:36Z, `gate-inventory-4a1a92d9.txt`, exit 0, three cross builds, alone). `36e5ff2d`: **passed** (00:26Z, alone). `403384c2`: **passed** (00:14Z, alone). `434cdf48`: **passed** (23:44Z, alone). Mutants in git-less tree copies with the killing tests logged from round five on: `inventory-mutants-round{1..6}.txt` | passed on `0e1bc298`, `434cdf48`, `403384c2`, `36e5ff2d` and `4a1a92d9` | **7 at `4a1a92d9`: both accept** (Opus: every sixth-round finding closed, two P3 bookkeeping items, neither required; Astra: accept, no new finding). 6 at `36e5ff2d`: Opus accept (three P3), Astra accept with fixes (one P2: Object Lambda's management actions in the s3 namespace on an Object Lambda resource), answered in `4a1a92d9`. 5 at `403384c2`: both accept with fixes (one P2 each: the possible-reach rule's text reading skipped for a complete pattern with a question mark across a colon; decision 14 understating the host role), answered in `36e5ff2d`. 5 at `403384c2`: running since 00:57 (Opus's third reading and Astra). 4 at `434cdf48`: Opus accept with fixes (two P2 required: an incomplete ARN read only as padded fields dropped grants the text reading reported; the legend wrong in the under-reporting direction), Astra reject (three P2: the Storage Lens exclusion dropped a write path; empty condition shapes read as a report; the legend), all answered in `403384c2`. 3 at `0e1bc298`: Opus accept with fixes (two P2 required: other S3 resource types dropped; the attestation plan still claiming an IAM read proves completeness), Astra reject (four P2, two P3). Answered; gate not yet run; never run against AWS. 1 at `d61f4f27`: Astra reject (three P1). Answered in `199a9736` by making it a report. 2 at `199a9736`: Astra reject (six P2: access-point grants under-reported; duplicate JSON members; default-version metadata not checked; trust-policy grammar; the two proposals overstated). Opus not yet read. Answered in `0e1bc298`; the third review (Astra) and Opus's first reading running on it | **merged into this branch at `c4ee8807` (01:40, a merge commit) after round seven's two acceptances, the gate and CI on `4a1a92d9`; the gate on the merged tip `c4ee8807` is queued behind the currency gate**; a report for a person, unwired; what a completeness claim needs is now decision 14 (an enforced rule; minted bucket names); the report can be run by an operator with their own credentials; never run against AWS |
| | `design-per-line-tax-codes` | `12590e3a` (per-line tax codes for a month in which the plan changed, OUTSTANDING item 17: the mechanics either answer to decision 16 needs, built behind the hold; design revision 6 after three Astra design rounds; Tasks 0 to 4, the activation glue uncalled, three mutant batches) | `12590e3a`: **passed** (05:08Z, `gate-taxcodes-12590e3a.txt`, exit 0, three cross builds, alone); also `6488c198`, `8715e4cd`, `61313bec`, each alone; each commit had the full console, plans and billingstripe run | passed on `61313bec`, `8715e4cd`, `6488c198` and `12590e3a` | 1 at `61313bec`: both accept with fixes (Opus one P2, Astra three P2); 2 at `8715e4cd`: both accept with fixes (P3s only); 3 at `6488c198`, confirming: both accept with fixes (P3s only, no further round required), the fixes in `12590e3a` | **merged into this branch at `e2adf26f` (06:10, a merge commit) with Task 5's records; a two-code month still holds; decision 16 and 16a to 16d are Paul's; every one-code month is byte-identical (pinned); one behaviour changes for every month: a resumed finalize validates the draft it read** | |
| +| `design-replicator-pinned-root` | `afd4dde0` (design only, revision 1: the replicator's authority, answering review twenty's eleven deferred findings: every open beneath a pinned root, the litestream fork beneath the same roots, ownership holds that survive exit through a fleet journal and admission columns in the durability ledger, claims keyed by file identity, required coverage; decisions 10-13 and approval H kept as parameters; off the replicator branch at `e1280811`) | not applicable (a document) | not applicable | design review 1 (Astra) running since 06:26 | nothing built or wired; the plan's parameter-independent tasks follow the review | |
| | site `feat/paid-pricing-20260916` (GitHub) | `01b62f7` (the money renderer a module the test calls); before it `4026231` (`build` and `check` render from the export before the draft check, so a stale page cannot be published past a newer export; a floor that is not whole cents is refused by the renderer rather than shown as `$1.20.5`; after `c12318d`: `bands.p3` replaced by the approved explanation, every priced slot, inclusion band and figure token pinned exactly) | `node --test test/*.test.mjs`: 21 pass (09:1xZ) | n/a | read-only by the currency reviews (section K); rounds four, five, ten, twelve to seventeen's site findings fixed | preview served at `http://100.119.180.57:38009` from the tree (rebuilt with the `bands.p3` change) | |
| ## The flow, behaviour the tests establish (2026-10-02) |