amadan

carlos / platform Public

census-ruling-claim-untagged-pointer: record platform-1e's acceptance

platform-1e accepted the claim-untagged-pointer census as proposed
(channelInstall.run and openChannelPolicy re-pinned with corrected bases
at unchanged digests, sites and class F,J4; the internal/host envelope
re-pinned; no 9B8 entry; the seal stands). rev3 is now
census-ruling-claim-untagged-pointer, and the overlay header, the loader
comment and the proposal's status say ruled.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claude 6892bdd97a48989eef36616edf884c90469e58e3 parent 255b0b3
3 files changed, +7 −7
  • docs/superpowers/notes/census-proposal-claim-untagged-pointer.md +1 −1
  • internal/provision/plan14_root_reads_test.go +3 −3
  • internal/provision/testdata/plan14-root-reads-claim-untagged-pointer.tsv +3 −3

CI passed — run details

CI log 
=== gate ===
cd launchctx && go vet ./... && go test ./... -count=1
ok  	amadan.net/carlos/platform.git/launchctx	0.011s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok  	github.com/carlosframework/platform	302.177s
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	2.783s
ok  	github.com/carlosframework/platform/cmd/moveprobe	93.375s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.707s
ok  	github.com/carlosframework/platform/internal/activator	250.734s
ok  	github.com/carlosframework/platform/internal/agentsock	0.035s
ok  	github.com/carlosframework/platform/internal/alerting	0.009s
ok  	github.com/carlosframework/platform/internal/analytics	0.023s
ok  	github.com/carlosframework/platform/internal/appconfig	2.537s
ok  	github.com/carlosframework/platform/internal/apperr	0.094s
ok  	github.com/carlosframework/platform/internal/applog	0.172s
ok  	github.com/carlosframework/platform/internal/awsinv	0.010s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.010s
ok  	github.com/carlosframework/platform/internal/boxid	0.804s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.012s
ok  	github.com/carlosframework/platform/internal/caps	0.018s
ok  	github.com/carlosframework/platform/internal/certwarm	0.004s
ok  	github.com/carlosframework/platform/internal/cgroup	0.723s
ok  	github.com/carlosframework/platform/internal/changelog	0.347s
ok  	github.com/carlosframework/platform/internal/claimactivation	0.842s
ok  	github.com/carlosframework/platform/internal/clamd	0.063s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
ok  	github.com/carlosframework/platform/internal/console	401.424s
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	6.163s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.009s
ok  	github.com/carlosframework/platform/internal/dbverify	0.004s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.004s
ok  	github.com/carlosframework/platform/internal/docsite	0.005s
ok  	github.com/carlosframework/platform/internal/domains	2.416s
ok  	github.com/carlosframework/platform/internal/doorkey	0.008s
ok  	github.com/carlosframework/platform/internal/economics	0.004s
ok  	github.com/carlosframework/platform/internal/edge	44.988s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.008s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.140s
ok  	github.com/carlosframework/platform/internal/gate	1.667s
ok  	github.com/carlosframework/platform/internal/genselect	0.021s
ok  	github.com/carlosframework/platform/internal/geo	0.013s
ok  	github.com/carlosframework/platform/internal/geoip	0.032s
ok  	github.com/carlosframework/platform/internal/historyreadback	0.164s
ok  	github.com/carlosframework/platform/internal/host	183.843s
ok  	github.com/carlosframework/platform/internal/hostactors	6.591s
ok  	github.com/carlosframework/platform/internal/hostactors/awsmembership	0.005s
ok  	github.com/carlosframework/platform/internal/hostbox	2.638s
ok  	github.com/carlosframework/platform/internal/hostclaim	0.534s
ok  	github.com/carlosframework/platform/internal/hostenv	0.008s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.005s
ok  	github.com/carlosframework/platform/internal/hostexec	4.989s
ok  	github.com/carlosframework/platform/internal/hostfence	0.029s
ok  	github.com/carlosframework/platform/internal/hostfiles	10.481s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.014s
ok  	github.com/carlosframework/platform/internal/hostguard	1.032s
ok  	github.com/carlosframework/platform/internal/hostops	1.575s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.002s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.002s
ok  	github.com/carlosframework/platform/internal/hostrelocate	0.440s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.146s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.001s
ok  	github.com/carlosframework/platform/internal/infraview	0.002s
ok  	github.com/carlosframework/platform/internal/instancectl	5.240s
ok  	github.com/carlosframework/platform/internal/instanceexec	2.733s
ok  	github.com/carlosframework/platform/internal/instancefs	0.017s
ok  	github.com/carlosframework/platform/internal/instancekey	0.014s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.021s
ok  	github.com/carlosframework/platform/internal/layout	1.517s
ok  	github.com/carlosframework/platform/internal/lbhealth	0.003s
ok  	github.com/carlosframework/platform/internal/lease	9.854s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.006s
ok  	github.com/carlosframework/platform/internal/ledger	0.015s
ok  	github.com/carlosframework/platform/internal/mail	0.166s
ok  	github.com/carlosframework/platform/internal/maintenance	0.077s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	5.493s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.079s
ok  	github.com/carlosframework/platform/internal/metrics	0.005s
ok  	github.com/carlosframework/platform/internal/moves	21.071s
ok  	github.com/carlosframework/platform/internal/moves/archive	0.827s
ok  	github.com/carlosframework/platform/internal/objstore	0.172s
ok  	github.com/carlosframework/platform/internal/ops	0.173s
ok  	github.com/carlosframework/platform/internal/park	0.199s
ok  	github.com/carlosframework/platform/internal/privatefile	0.003s
ok  	github.com/carlosframework/platform/internal/provision	35.892s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.007s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	5.457s
ok  	github.com/carlosframework/platform/internal/relay	7.244s
ok  	github.com/carlosframework/platform/internal/release	24.588s
ok  	github.com/carlosframework/platform/internal/rollout	3.826s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.003s
ok  	github.com/carlosframework/platform/internal/rootaws	0.006s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.057s
ok  	github.com/carlosframework/platform/internal/rootstate	0.028s
ok  	github.com/carlosframework/platform/internal/runs	0.567s
ok  	github.com/carlosframework/platform/internal/s3compat	0.007s
ok  	github.com/carlosframework/platform/internal/safefile	0.004s
ok  	github.com/carlosframework/platform/internal/schedule	2.479s
ok  	github.com/carlosframework/platform/internal/seeds	0.011s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	9.588s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	3.669s
ok  	github.com/carlosframework/platform/internal/status	0.062s
ok  	github.com/carlosframework/platform/internal/steering	0.006s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.220s
ok  	github.com/carlosframework/platform/internal/svcrole	0.002s
ok  	github.com/carlosframework/platform/internal/telemetry	0.004s
ok  	github.com/carlosframework/platform/internal/termfence	0.005s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.007s
ok  	github.com/carlosframework/platform/internal/unixdial	0.002s
ok  	github.com/carlosframework/platform/internal/updatewords	0.004s
ok  	github.com/carlosframework/platform/internal/usage	0.004s
ok  	github.com/carlosframework/platform/internal/version	0.002s
ok  	github.com/carlosframework/platform/internal/vet	1.559s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
linux/arm64 carlos binary: 49414306 bytes (ceiling 52000000)
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
  minio: downloading https://github.com/minio/minio/releases/download/RELEASE.2025-09-07T16-13-09Z/minio.linux-arm64.RELEASE.2025-09-07T16-13-09Z
  minio: downloaded, digest verified
  mc: downloading https://github.com/minio/mc/releases/download/RELEASE.2025-08-13T08-35-41Z/mc.linux-arm64.RELEASE.2025-08-13T08-35-41Z
  mc: downloaded, digest verified
  minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
  buckets and scoped user ready
=== RUN   TestDeliveredContractMinio
=== RUN   TestDeliveredContractMinio/put
=== RUN   TestDeliveredContractMinio/get_round-trips_the_body
=== RUN   TestDeliveredContractMinio/list_shows_the_key
=== RUN   TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN   TestDeliveredContractMinio/delete_removes_it
=== RUN   TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
    --- PASS: TestDeliveredContractMinio/put (0.00s)
    --- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
    --- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
    --- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
    --- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
    --- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok  	github.com/carlosframework/platform/internal/objstore	0.021s
=== RUN   TestT4StorageProbeMinio
2026/10/18 16:48:59 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18DFADADE204E70C, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.00s)
PASS
ok  	github.com/carlosframework/platform/internal/host	0.020s
minio contract: PASS
diff --git a/docs/superpowers/notes/census-proposal-claim-untagged-pointer.md b/docs/superpowers/notes/census-proposal-claim-untagged-pointer.md
index 0bd7ecfe7..84b619ee1 100644
--- a/docs/superpowers/notes/census-proposal-claim-untagged-pointer.md
+++ b/docs/superpowers/notes/census-proposal-claim-untagged-pointer.md
@@ -1,6 +1,6 @@
# Census proposal: claim-untagged-pointer
-Status: PROPOSED. Overlay `internal/provision/testdata/plan14-root-reads-claim-untagged-pointer.tsv`, loaded last (after `claim-prev-rehearsal-fix2`), every row `rev3=PROPOSED-claim-untagged-pointer`.
+Status: RULED. platform-1e accepted every row as proposed on 2026-10-18 (census-ruling-claim-untagged-pointer): no 9B8 entry, and the seal stands. Overlay `internal/provision/testdata/plan14-root-reads-claim-untagged-pointer.tsv`, loaded last (after `claim-prev-rehearsal-fix2`), every row `rev3=census-ruling-claim-untagged-pointer`.
## What changed
diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go
index 94ca97e2e..42bca2440 100644
--- a/internal/provision/plan14_root_reads_test.go
+++ b/internal/provision/plan14_root_reads_test.go
@@ -887,9 +887,9 @@ func TestPlan14RootReadCensus(t *testing.T) {
// Census overlay claim-untagged-pointer (install-channel --policy takes
// --identity, the published release identity, because the channel
// pointer carlos system update writes before a floor is published
- // carries no release tag; controller ruling R1), loaded last. PROPOSED
- // (rev3=PROPOSED-claim-untagged-pointer;
- // docs/superpowers/notes/census-proposal-claim-untagged-pointer.md):
+ // carries no release tag; controller ruling R1), loaded last, under
+ // census-ruling-claim-untagged-pointer (platform-1e, accepted as
+ // proposed; docs/superpowers/notes/census-proposal-claim-untagged-pointer.md):
// channelInstall.run and openChannelPolicy re-pinned with corrected
// bases at unchanged digests, sites and class F,J4, and the internal/host
// envelope re-pinned. It adds no accepted-legacy row, so the seal stands.
diff --git a/internal/provision/testdata/plan14-root-reads-claim-untagged-pointer.tsv b/internal/provision/testdata/plan14-root-reads-claim-untagged-pointer.tsv
index 41cad831e..e2106fe44 100644
--- a/internal/provision/testdata/plan14-root-reads-claim-untagged-pointer.tsv
+++ b/internal/provision/testdata/plan14-root-reads-claim-untagged-pointer.tsv
@@ -1,7 +1,7 @@
-# Census overlay claim-untagged-pointer (claim trial: install-channel --policy also takes --identity FILE, the published release identity, because the channel pointer carlos system update writes before a floor is published carries no release tag; controller ruling R1), loaded LAST, after claim-prev-rehearsal-fix2. PROPOSED: docs/superpowers/notes/census-proposal-claim-untagged-pointer.md.
+# Census overlay claim-untagged-pointer (claim trial: install-channel --policy also takes --identity FILE, the published release identity, because the channel pointer carlos system update writes before a floor is published carries no release tag; controller ruling R1), loaded LAST, after claim-prev-rehearsal-fix2. RULED by platform-1e 2026-10-18 as census-ruling-claim-untagged-pointer: every row ACCEPTED as proposed (channelInstall.run and openChannelPolicy re-pinned with corrected bases at unchanged digests, sites and class F,J4; internal/host envelope re-pinned; the seal stands, no 9B8 entry); docs/superpowers/notes/census-proposal-claim-untagged-pointer.md.
# Without --policy nothing changes (ruling 6): channelInstall.run's digest, sites and class F,J4 are unchanged and only its basis is corrected; refreshPrev, slotState, var openat2 and removeBeneath are unchanged and stay their ruled rows. readChannelInputs, channelInstall.channelIdentity and the reworked checkFloor have no read site of their own (envelope only): the identity is read once through openChannelPolicy, verified under CARLOS_RELEASE_PUBKEY, compared byte for byte with the bucket's object at release.IdentityKey of its own tag, and matched to the verified pointer's version and this platform's artifact sha256 (and its tag, if it carries one).
# openChannelPolicy keeps its digest, sites and class F,J4; its basis is corrected because it now also reads the operator-staged --identity file, with the same hardened open, before the apply lock or any store read.
# The seal stands: no accepted-legacy row. No box agent, update, recovery or edge path reaches any changed unit. The 9B8 inventory is unchanged: install-channel writes only local files, and nothing here writes to a bucket.
@coverage internal/host 2dcf104b5bdc76cc52834f0bb88adf2f2314ae71bd5856a0de8d7b310803026c
-internal/host/installchannel.go channelInstall.run authority F,J4 rev3=PROPOSED-claim-untagged-pointer;identity=uid 0 at a fresh box's start-up, and with --policy --identity at an updated box's attended root shell (carlos system install-channel);basis=carlos system install-channel (root): at a fresh box's start-up, and with --policy and --identity also at an updated box's attended root shell before the host floor is published; its one read site opens root's apply lock; the install goes through verifyPointer, hostfloor.CheckImage (against the published floor and the identity the pointer's release tag names, or with --policy against the verified policy floor and the --identity file, which must be the identity published under its own tag and name the pointer's version, this platform's artifact sha256 and any tag the pointer carries) and stageCandidate into both protected slots, or with --policy on an updated box at the channel head through refreshPrev; it refuses a box whose guard is armed or that already runs another release, and with --policy a box whose update has not finished file:OpenFile@196 f0cdb6dd28e83da282c3b0d7bc2012dcd80db181a8cecbf1a2db6bcc41d1d5e3
-internal/host/installchannel_linux.go openChannelPolicy authority F,J4 rev3=PROPOSED-claim-untagged-pointer;identity=uid 0 at the box's attended root shell (carlos system install-channel --policy --identity);basis=reads each operator-staged file install-channel --policy takes, the --policy file and the --identity file, once each, before the apply lock or any store read: opened with O_NOFOLLOW (a symlink is refused) and O_NONBLOCK (a FIFO does not block), fstat'd to be a regular file of at most 64 KiB, then read from the descriptor up to that cap; the policy's bytes are used only after channelPolicy verifies the root-signed moves-protocol authorization for this deployment's bucket under CARLOS_RELEASE_PUBKEY, and a published floor must equal them byte for byte; the identity's bytes only after channelIdentity verifies them under the same key and finds them equal to the bucket's object at release.IdentityKey of their own tag file:Open@79,file:ReadAll@485,file:Stat@263 eb5725bd24aa51f5d4f93b01a065351a278bb82cbf013a106b2f1fba36987f94
+internal/host/installchannel.go channelInstall.run authority F,J4 rev3=census-ruling-claim-untagged-pointer;identity=uid 0 at a fresh box's start-up, and with --policy --identity at an updated box's attended root shell (carlos system install-channel);basis=carlos system install-channel (root): at a fresh box's start-up, and with --policy and --identity also at an updated box's attended root shell before the host floor is published; its one read site opens root's apply lock; the install goes through verifyPointer, hostfloor.CheckImage (against the published floor and the identity the pointer's release tag names, or with --policy against the verified policy floor and the --identity file, which must be the identity published under its own tag and name the pointer's version, this platform's artifact sha256 and any tag the pointer carries) and stageCandidate into both protected slots, or with --policy on an updated box at the channel head through refreshPrev; it refuses a box whose guard is armed or that already runs another release, and with --policy a box whose update has not finished file:OpenFile@196 f0cdb6dd28e83da282c3b0d7bc2012dcd80db181a8cecbf1a2db6bcc41d1d5e3
+internal/host/installchannel_linux.go openChannelPolicy authority F,J4 rev3=census-ruling-claim-untagged-pointer;identity=uid 0 at the box's attended root shell (carlos system install-channel --policy --identity);basis=reads each operator-staged file install-channel --policy takes, the --policy file and the --identity file, once each, before the apply lock or any store read: opened with O_NOFOLLOW (a symlink is refused) and O_NONBLOCK (a FIFO does not block), fstat'd to be a regular file of at most 64 KiB, then read from the descriptor up to that cap; the policy's bytes are used only after channelPolicy verifies the root-signed moves-protocol authorization for this deployment's bucket under CARLOS_RELEASE_PUBKEY, and a published floor must equal them byte for byte; the identity's bytes only after channelIdentity verifies them under the same key and finds them equal to the bucket's object at release.IdentityKey of their own tag file:Open@79,file:ReadAll@485,file:Stat@263 eb5725bd24aa51f5d4f93b01a065351a278bb82cbf013a106b2f1fba36987f94