amadan
plans: Astra plan review R2 findings (instance policy)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+23
−0
docs/superpowers/plans/CODEX-FINDINGS-instance-policy-plans-R2.md+23 −0
CI passed — run details
CI log
=== gate ===
.amadan/test-gate.sh
go: downloading golang.org/x/net v0.56.0
go: downloading golang.org/x/crypto v0.53.0
go: downloading golang.org/x/sys v0.46.0
go: downloading golang.org/x/sync v0.21.0
go: downloading github.com/pion/stun/v3 v3.0.1
go: downloading github.com/pion/transport/v4 v4.0.1
go: downloading github.com/pion/transport/v3 v3.0.8
go: downloading github.com/pion/dtls/v3 v3.0.7
go: downloading golang.org/x/text v0.38.0
go: downloading golang.org/x/text v0.38.0
=== launchctx (0 s)
ok amadan.net/carlos/platform.git/launchctx 0.012s
? amadan.net/carlos/platform.git/launchctx/controlname [no test files]
? amadan.net/carlos/platform.git/launchctx/wireid [no test files]
=== vet (34 s)
go: downloading golang.org/x/tools v0.47.0
go: downloading golang.org/x/text v0.38.0
go: downloading golang.org/x/mod v0.37.0
=== gofmt (0 s)
gofmt -l .: clean
=== rest (175 s)
? github.com/carlosframework/platform/cmd/changelog [no test files]
ok github.com/carlosframework/platform/cmd/console 5.060s
ok github.com/carlosframework/platform/cmd/moveprobe 12.798s
ok github.com/carlosframework/platform/cmd/zddprobe 1.095s
ok github.com/carlosframework/platform/internal/activator 64.824s
ok github.com/carlosframework/platform/internal/agentsock 0.049s
ok github.com/carlosframework/platform/internal/alerting 0.027s
ok github.com/carlosframework/platform/internal/analytics 0.096s
ok github.com/carlosframework/platform/internal/appconfig 3.618s
ok github.com/carlosframework/platform/internal/apperr 0.336s
ok github.com/carlosframework/platform/internal/applog 0.367s
ok github.com/carlosframework/platform/internal/awsinv 0.025s
ok github.com/carlosframework/platform/internal/boxchoice 0.030s
ok github.com/carlosframework/platform/internal/boxid 0.788s
? github.com/carlosframework/platform/internal/boxid/boxidtest [no test files]
? github.com/carlosframework/platform/internal/boxid/internal/signtest [no test files]
ok github.com/carlosframework/platform/internal/boxvolumes 0.026s
ok github.com/carlosframework/platform/internal/caps 0.037s
ok github.com/carlosframework/platform/internal/certwarm 0.010s
ok github.com/carlosframework/platform/internal/cgroup 0.920s
ok github.com/carlosframework/platform/internal/changelog 1.285s
ok github.com/carlosframework/platform/internal/claimactivation 2.069s
ok github.com/carlosframework/platform/internal/clamd 0.127s
? github.com/carlosframework/platform/internal/cliflag [no test files]
? github.com/carlosframework/platform/internal/controlname [no test files]
? github.com/carlosframework/platform/internal/controlsock [no test files]
ok github.com/carlosframework/platform/internal/dbdoor 6.083s
ok github.com/carlosframework/platform/internal/dbdoor/dbdoortest 0.029s
ok github.com/carlosframework/platform/internal/dbverify 0.022s
ok github.com/carlosframework/platform/internal/dnsrec 0.004s
ok github.com/carlosframework/platform/internal/docsite 0.056s
ok github.com/carlosframework/platform/internal/domains 4.022s
ok github.com/carlosframework/platform/internal/doorkey 0.013s
ok github.com/carlosframework/platform/internal/economics 0.014s
ok github.com/carlosframework/platform/internal/edge 46.700s
? github.com/carlosframework/platform/internal/edgeproof [no test files]
ok github.com/carlosframework/platform/internal/edgesfile 0.010s
ok github.com/carlosframework/platform/internal/fleetapi 0.162s
ok github.com/carlosframework/platform/internal/gate 1.766s
ok github.com/carlosframework/platform/internal/genselect 0.032s
ok github.com/carlosframework/platform/internal/geo 0.014s
ok github.com/carlosframework/platform/internal/geoip 0.068s
ok github.com/carlosframework/platform/internal/historyreadback 0.291s
ok github.com/carlosframework/platform/internal/host 129.919s
ok github.com/carlosframework/platform/internal/hostactors 8.942s
ok github.com/carlosframework/platform/internal/hostactors/awsmembership 0.016s
ok github.com/carlosframework/platform/internal/hostbox 4.564s
ok github.com/carlosframework/platform/internal/hostclaim 1.799s
ok github.com/carlosframework/platform/internal/hostenv 0.005s
ok github.com/carlosframework/platform/internal/hostevidence 0.006s
ok github.com/carlosframework/platform/internal/hostexec 9.095s
ok github.com/carlosframework/platform/internal/hostfence 0.133s
ok github.com/carlosframework/platform/internal/hostfiles 12.014s
ok github.com/carlosframework/platform/internal/hostfloor 0.051s
ok github.com/carlosframework/platform/internal/hostguard 1.176s
ok github.com/carlosframework/platform/internal/hostops 3.240s
? github.com/carlosframework/platform/internal/hostops/fencerelease [no test files]
ok github.com/carlosframework/platform/internal/hostops/internal/fencerelease 0.006s
ok github.com/carlosframework/platform/internal/hostquarantine 0.004s
ok github.com/carlosframework/platform/internal/hostrelocate 1.466s
ok github.com/carlosframework/platform/internal/hostresolve 0.372s
ok github.com/carlosframework/platform/internal/hostwrite 0.005s
ok github.com/carlosframework/platform/internal/infraview 0.005s
ok github.com/carlosframework/platform/internal/instancectl 5.334s
ok github.com/carlosframework/platform/internal/instanceexec 3.127s
ok github.com/carlosframework/platform/internal/instancefs 0.009s
ok github.com/carlosframework/platform/internal/instancekey 0.006s
ok github.com/carlosframework/platform/internal/instanceupdates 0.009s
ok github.com/carlosframework/platform/internal/layout 2.815s
ok github.com/carlosframework/platform/internal/lbhealth 0.004s
ok github.com/carlosframework/platform/internal/lease 10.623s
ok github.com/carlosframework/platform/internal/lease/leasetest 0.660s
ok github.com/carlosframework/platform/internal/ledger 0.046s
ok github.com/carlosframework/platform/internal/mail 0.424s
ok github.com/carlosframework/platform/internal/maintenance 0.145s
ok github.com/carlosframework/platform/internal/maintenanceexec 6.219s
ok github.com/carlosframework/platform/internal/maintenanceguard 0.249s
ok github.com/carlosframework/platform/internal/metrics 0.029s
ok github.com/carlosframework/platform/internal/moves 24.652s
ok github.com/carlosframework/platform/internal/moves/archive 1.736s
ok github.com/carlosframework/platform/internal/objstore 0.486s
ok github.com/carlosframework/platform/internal/ops 0.405s
ok github.com/carlosframework/platform/internal/park 0.608s
ok github.com/carlosframework/platform/internal/plans 0.009s
ok github.com/carlosframework/platform/internal/privatefile 0.005s
ok github.com/carlosframework/platform/internal/provision 35.065s
ok github.com/carlosframework/platform/internal/publicrelease 0.029s
? github.com/carlosframework/platform/internal/regionname [no test files]
ok github.com/carlosframework/platform/internal/registry 7.706s
ok github.com/carlosframework/platform/internal/relay 7.313s
ok github.com/carlosframework/platform/internal/release 29.873s
ok github.com/carlosframework/platform/internal/rollout 5.224s
ok github.com/carlosframework/platform/internal/rolloutwords 0.020s
ok github.com/carlosframework/platform/internal/rootaws 0.036s
ok github.com/carlosframework/platform/internal/rootparticipation 0.134s
ok github.com/carlosframework/platform/internal/rootstate 0.040s
ok github.com/carlosframework/platform/internal/runs 0.935s
ok github.com/carlosframework/platform/internal/s3compat 0.005s
ok github.com/carlosframework/platform/internal/safefile 0.005s
ok github.com/carlosframework/platform/internal/schedule 4.133s
ok github.com/carlosframework/platform/internal/seeds 0.021s
ok github.com/carlosframework/platform/internal/sim/hostlife 18.012s
ok github.com/carlosframework/platform/internal/sim/litestreamfacts 4.025s
ok github.com/carlosframework/platform/internal/status 0.115s
ok github.com/carlosframework/platform/internal/steering 0.009s
ok github.com/carlosframework/platform/internal/stopevidence 0.510s
ok github.com/carlosframework/platform/internal/svcrole 0.005s
ok github.com/carlosframework/platform/internal/telemetry 0.006s
ok github.com/carlosframework/platform/internal/termfence 0.006s
ok github.com/carlosframework/platform/internal/tunnelclient 0.006s
ok github.com/carlosframework/platform/internal/unixdial 0.004s
ok github.com/carlosframework/platform/internal/updatewords 0.026s
ok github.com/carlosframework/platform/internal/usage 0.033s
ok github.com/carlosframework/platform/internal/version 0.003s
ok github.com/carlosframework/platform/internal/vet 1.901s
=== internal_console@0 (212 s)
ok github.com/carlosframework/platform/internal/console 209.603s
=== internal_console@1 (40 s)
ok github.com/carlosframework/platform/internal/console 37.607s
=== internal_console@2 (39 s)
ok github.com/carlosframework/platform/internal/console 36.709s
=== internal_console@3 (41 s)
ok github.com/carlosframework/platform/internal/console 39.003s
=== internal_console@4 (42 s)
ok github.com/carlosframework/platform/internal/console 39.706s
=== internal_console@5 (43 s)
ok github.com/carlosframework/platform/internal/console 41.144s
=== internal_console@6 (44 s)
ok github.com/carlosframework/platform/internal/console 41.277s
=== internal_console@7 (43 s)
ok github.com/carlosframework/platform/internal/console 40.311s
=== root@0 (41 s)
ok github.com/carlosframework/platform 38.823s
=== root@1 (48 s)
ok github.com/carlosframework/platform 46.428s
=== root@2 (47 s)
ok github.com/carlosframework/platform 44.615s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
linux/arm64 carlos binary: 49873058 bytes (ceiling 52000000)
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
minio: cached, digest verified
mc: cached, digest verified
minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
buckets and scoped user ready
=== RUN TestDeliveredContractMinio
=== RUN TestDeliveredContractMinio/put
=== RUN TestDeliveredContractMinio/get_round-trips_the_body
=== RUN TestDeliveredContractMinio/list_shows_the_key
=== RUN TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN TestDeliveredContractMinio/delete_removes_it
=== RUN TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
--- PASS: TestDeliveredContractMinio/put (0.00s)
--- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
--- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
--- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
--- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok github.com/carlosframework/platform/internal/objstore 0.026s
=== RUN TestT4StorageProbeMinio
2026/10/24 21:40:31 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18E195120AFCCD64, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.01s)
PASS
ok github.com/carlosframework/platform/internal/host 0.023s
minio contract: PASS
diff --git a/docs/superpowers/plans/CODEX-FINDINGS-instance-policy-plans-R2.md b/docs/superpowers/plans/CODEX-FINDINGS-instance-policy-plans-R2.md| new file mode 100644 |
| index 000000000..f9ab97c9f |
| --- /dev/null |
| +++ b/docs/superpowers/plans/CODEX-FINDINGS-instance-policy-plans-R2.md |
| @@ -0,0 +1,23 @@ |
| +R1-1 — RESOLVED: signed content and revision are recorded before publication. |
| +R1-2 — RESOLVED: a mismatched `AppID` starts from empty policy. |
| +R1-3 — RESOLVED: pre-claim store outages now respect the persisted expiry. |
| +R1-4 — RESOLVED: the new table and SQL adapters are classified. |
| +R1-5 — RESOLVED: assembly construction precedes source binding. |
| +R1-6 — RESOLVED: acceptance targets use a separate network namespace. |
| +R1-7 — RESOLVED: the kernel witness uses `os.Executable()`. |
| +R1-8 — RESOLVED: logical generations use the slice-only resize path. |
| +R1-9 — RESOLVED: partial growth remains unsettled until reconciled. |
| +R1-10 — RESOLVED: size-table initializers are literals. |
| +R1-11 — RESOLVED: the witness regrants before injecting a failed revoke. |
| + |
| +1. **P1 — Plan 2, Task 6: unsigned admission data can reset the revision floor and revive a predecessor’s grant.** [Egress:326](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-egress-sizes-328-329/docs/superpowers/plans/2026-10-21-instance-policy-2-egress.md:326) trusts the admission’s `AppID`, then replaces the floor whenever that ID differs. But [ReadCanonicalAdmission:131](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-egress-sizes-328-329/internal/hostops/admission.go:131) only decodes unsigned bucket JSON. The agent’s role can overwrite it ([IAM:166](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-egress-sizes-328-329/infra/modules/region-host/main.tf:166)). A compromised agent can restore a predecessor’s admission and unexpired signed policy; the incarnation comparison passes and root replaces the current floor with the predecessor’s revision. `rootInstallationHostApp` checks the installed host’s account/app, but never binds this admission’s app ID. **Smallest fix:** authenticate the current app incarnation independently of mutable admission JSON, and retain the revision floor across incarnation changes—Plan 1 already keeps revisions increasing across recreation. Test replaying both admission and policy against an existing installation. |
| + |
| +2. **P1 — Plan 1, Tasks 8–9: two consoles can sign different content at the same revision and overwrite a revoke.** [Foundation:598](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-egress-sizes-328-329/docs/superpowers/plans/2026-10-21-instance-policy-1-foundation.md:598) retries a CAS conflict using the same recorded bytes and a newly read ETag. Its assumption that only a bucket writer can cause that conflict is false across consoles: `policyLock` is process-local, and the revision table is in each console’s SQLite database ([store.go:74](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-egress-sizes-328-329/internal/console/store.go:74)). Two consoles reading revision 1 can independently record revision 2: one revokes, while the other changes size and retains the allow. The latter’s retry overwrites the revoke; root accepts the equal revision. Multiple upgraded consoles are explicitly permitted by spec §3. **Smallest fix:** coordinate revision allocation and publication across writers; never retry over competing signed content without reconciling it. Include recovery/re-signing in that coordination and test two independent console databases sharing one store. |
| + |
| +3. **P1 — Plan 2, Tasks 2 and 6: a control-service restart can make an allow survive its expiry indefinitely.** [Egress:174](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-egress-sizes-328-329/docs/superpowers/plans/2026-10-21-instance-policy-2-egress.md:174) explicitly requires a fresh asserter to leave existing slice allows untouched when its source fails. Under claims, the verified policy and expiry exist only in memory; the durable floor contains just `AppID` and revision ([Egress:304](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-egress-sizes-328-329/docs/superpowers/plans/2026-10-21-instance-policy-2-egress.md:304)). After restart during a sustained store outage, no cached policy exists to trigger the expiry check, so every sweep preserves the allow beyond 72 hours. **Smallest fix:** persist the verified signed policy and its binding in root-owned state, revalidate its expiry after restart, and close an allow whose validity cannot be established. Add a restart-plus-outage-past-expiry witness. |
| + |
| +4. **P1 — Plan 2, Tasks 2, 5–6: the pinned `EgressPolicy` type lacks a required field.** Its declaration at [Egress:116](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-egress-sizes-328-329/docs/superpowers/plans/2026-10-21-instance-policy-2-egress.md:116) contains only `Allow` and `Closed`, but the construction fix explicitly uses `EgressPolicy{Closed: EgressUnreadable, Detail: ...}` at [Egress:335](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-egress-sizes-328-329/docs/superpowers/plans/2026-10-21-instance-policy-2-egress.md:335). The expiry and incarnation sources also require `Detail`. This cannot compile as specified. **Smallest fix:** add `Detail string` to `EgressPolicy` and specify its propagation into `EgressReport`. |
| + |
| +5. **P1 — Plan 3, Task 9: boxes without edges files bypass the missing-memory-total refusal.** [Sizes:489](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-egress-sizes-328-329/docs/superpowers/plans/2026-10-21-instance-policy-3-sizes.md:489) constructs the candidate set solely from edges files. `Snapshot.Complete` only covers files actually listed ([snapshot.go:198](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-egress-sizes-328-329/internal/edgesfile/snapshot.go:198)); it does not detect a box that publishes none. Fleet boxes deliberately skip publication ([edgesfile.go:804](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-egress-sizes-328-329/internal/host/edgesfile.go:804)). Consequently, an eligible box with no published total disappears from the check instead of causing the required refusal above `standard`. **Smallest fix:** establish eligible boxes independently, join their published totals, and treat a missing file as an unknown total. Test a known eligible box with status but no edges file beside a sufficiently large published box. |
| + |
| +REJECT |
| \ No newline at end of file |