carlos / platform Public

moves: ParticipantRole compares placements through regionname, breaking the park test import cycle

internal/park's tests import internal/moves, so moves cannot import park.
PlacementMatches moves into internal/regionname, beside the SameRegion and
PlacementRegion it is made of; park.PlacementMatches delegates to it,
unchanged, and ParticipantRole's legacy branch calls it there. Census:
the internal/moves envelope re-pinned in place, internal/park and
internal/regionname added (PROPOSED-self-serve-moves-2).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

claude 2 days ago 6a93125a541aa58b7088577fb3cb471b59c239e0 parent d138725

5 files changed, +23 −9

internal/moves/participants.go +5 −4
internal/moves/participants_test.go +2 −2
internal/park/region_names.go +3 −2
internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv +4 −1
internal/regionname/region.go +9 −0

CI passed — run details

CI log

=== gate ===
.amadan/test-gate.sh
=== launchctx (2 s)
ok  	amadan.net/carlos/platform.git/launchctx	0.011s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
=== vet (19 s)
=== gofmt (1 s)
gofmt -l .: clean
=== rest (190 s)
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	3.647s
ok  	github.com/carlosframework/platform/cmd/moveprobe	11.672s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.756s
ok  	github.com/carlosframework/platform/internal/activator	60.643s
ok  	github.com/carlosframework/platform/internal/agentsock	0.025s
ok  	github.com/carlosframework/platform/internal/alerting	0.004s
ok  	github.com/carlosframework/platform/internal/analytics	0.030s
ok  	github.com/carlosframework/platform/internal/appconfig	2.863s
ok  	github.com/carlosframework/platform/internal/apperr	0.105s
ok  	github.com/carlosframework/platform/internal/applog	0.189s
ok  	github.com/carlosframework/platform/internal/awsinv	0.010s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.015s
ok  	github.com/carlosframework/platform/internal/boxid	0.720s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.014s
ok  	github.com/carlosframework/platform/internal/caps	0.021s
ok  	github.com/carlosframework/platform/internal/certwarm	0.002s
ok  	github.com/carlosframework/platform/internal/cgroup	0.749s
ok  	github.com/carlosframework/platform/internal/changelog	0.397s
ok  	github.com/carlosframework/platform/internal/claimactivation	0.988s
ok  	github.com/carlosframework/platform/internal/clamd	0.059s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	5.948s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.013s
ok  	github.com/carlosframework/platform/internal/dbverify	0.006s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.006s
ok  	github.com/carlosframework/platform/internal/docsite	0.017s
ok  	github.com/carlosframework/platform/internal/domains	2.906s
ok  	github.com/carlosframework/platform/internal/doorkey	0.010s
ok  	github.com/carlosframework/platform/internal/economics	0.007s
ok  	github.com/carlosframework/platform/internal/edge	45.963s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.009s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.158s
ok  	github.com/carlosframework/platform/internal/gate	1.670s
ok  	github.com/carlosframework/platform/internal/genselect	0.035s
ok  	github.com/carlosframework/platform/internal/geo	0.017s
ok  	github.com/carlosframework/platform/internal/geoip	0.040s
ok  	github.com/carlosframework/platform/internal/historyreadback	0.254s
ok  	github.com/carlosframework/platform/internal/host	161.706s
ok  	github.com/carlosframework/platform/internal/hostactors	6.140s
ok  	github.com/carlosframework/platform/internal/hostactors/awsmembership	0.006s
ok  	github.com/carlosframework/platform/internal/hostbox	3.028s
ok  	github.com/carlosframework/platform/internal/hostclaim	0.741s
ok  	github.com/carlosframework/platform/internal/hostenv	0.006s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.006s
ok  	github.com/carlosframework/platform/internal/hostexec	5.274s
ok  	github.com/carlosframework/platform/internal/hostfence	0.038s
ok  	github.com/carlosframework/platform/internal/hostfiles	10.288s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.025s
ok  	github.com/carlosframework/platform/internal/hostguard	1.062s
ok  	github.com/carlosframework/platform/internal/hostops	1.920s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.004s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.002s
ok  	github.com/carlosframework/platform/internal/hostrelocate	0.605s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.168s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.002s
ok  	github.com/carlosframework/platform/internal/infraview	0.007s
ok  	github.com/carlosframework/platform/internal/instancectl	5.228s
ok  	github.com/carlosframework/platform/internal/instanceexec	2.820s
ok  	github.com/carlosframework/platform/internal/instancefs	0.006s
ok  	github.com/carlosframework/platform/internal/instancekey	0.003s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.009s
ok  	github.com/carlosframework/platform/internal/layout	1.738s
ok  	github.com/carlosframework/platform/internal/lbhealth	0.008s
ok  	github.com/carlosframework/platform/internal/lease	10.166s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.485s
ok  	github.com/carlosframework/platform/internal/ledger	0.017s
ok  	github.com/carlosframework/platform/internal/mail	0.239s
ok  	github.com/carlosframework/platform/internal/maintenance	0.109s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	5.587s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.082s
ok  	github.com/carlosframework/platform/internal/metrics	0.006s
ok  	github.com/carlosframework/platform/internal/moves	21.927s
ok  	github.com/carlosframework/platform/internal/moves/archive	0.885s
ok  	github.com/carlosframework/platform/internal/objstore	0.341s
ok  	github.com/carlosframework/platform/internal/ops	0.243s
ok  	github.com/carlosframework/platform/internal/park	0.289s
ok  	github.com/carlosframework/platform/internal/plans	0.014s
ok  	github.com/carlosframework/platform/internal/privatefile	0.004s
ok  	github.com/carlosframework/platform/internal/provision	23.023s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.008s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	5.751s
ok  	github.com/carlosframework/platform/internal/relay	7.235s
ok  	github.com/carlosframework/platform/internal/release	25.062s
ok  	github.com/carlosframework/platform/internal/rollout	3.822s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.005s
ok  	github.com/carlosframework/platform/internal/rootaws	0.007s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.059s
ok  	github.com/carlosframework/platform/internal/rootstate	0.028s
ok  	github.com/carlosframework/platform/internal/runs	0.593s
ok  	github.com/carlosframework/platform/internal/s3compat	0.005s
ok  	github.com/carlosframework/platform/internal/safefile	0.004s
ok  	github.com/carlosframework/platform/internal/schedule	2.703s
ok  	github.com/carlosframework/platform/internal/seeds	0.011s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	9.895s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	3.832s
ok  	github.com/carlosframework/platform/internal/status	0.073s
ok  	github.com/carlosframework/platform/internal/steering	0.009s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.051s
ok  	github.com/carlosframework/platform/internal/svcrole	0.003s
ok  	github.com/carlosframework/platform/internal/telemetry	0.006s
ok  	github.com/carlosframework/platform/internal/termfence	0.005s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.010s
ok  	github.com/carlosframework/platform/internal/unixdial	0.003s
ok  	github.com/carlosframework/platform/internal/updatewords	0.007s
ok  	github.com/carlosframework/platform/internal/usage	0.006s
ok  	github.com/carlosframework/platform/internal/version	0.001s
ok  	github.com/carlosframework/platform/internal/vet	1.640s
=== internal_console@0 (89 s)
ok  	github.com/carlosframework/platform/internal/console	87.561s
=== internal_console@1 (44 s)
ok  	github.com/carlosframework/platform/internal/console	42.225s
=== internal_console@2 (40 s)
ok  	github.com/carlosframework/platform/internal/console	39.025s
=== internal_console@3 (50 s)
ok  	github.com/carlosframework/platform/internal/console	48.351s
=== internal_console@4 (41 s)
ok  	github.com/carlosframework/platform/internal/console	39.580s
=== internal_console@5 (37 s)
ok  	github.com/carlosframework/platform/internal/console	35.714s
=== internal_console@6 (46 s)
ok  	github.com/carlosframework/platform/internal/console	44.988s
=== internal_console@7 (44 s)
ok  	github.com/carlosframework/platform/internal/console	42.830s
=== root@0 (30 s)
ok  	github.com/carlosframework/platform	28.838s
=== root@1 (44 s)
ok  	github.com/carlosframework/platform	42.810s
=== root@2 (46 s)
ok  	github.com/carlosframework/platform	44.663s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
linux/arm64 carlos binary: 50266274 bytes (ceiling 52000000)
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
  minio: cached, digest verified
  mc: cached, digest verified
  minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
  buckets and scoped user ready
=== RUN   TestDeliveredContractMinio
=== RUN   TestDeliveredContractMinio/put
=== RUN   TestDeliveredContractMinio/get_round-trips_the_body
=== RUN   TestDeliveredContractMinio/list_shows_the_key
=== RUN   TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN   TestDeliveredContractMinio/delete_removes_it
=== RUN   TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
    --- PASS: TestDeliveredContractMinio/put (0.00s)
    --- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
    --- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
    --- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
    --- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
    --- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok  	github.com/carlosframework/platform/internal/objstore	0.023s
=== RUN   TestT4StorageProbeMinio
2026/10/23 11:03:36 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18E123BBD1564FC0, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.01s)
PASS
ok  	github.com/carlosframework/platform/internal/host	0.022s
minio contract: PASS

diff --git a/internal/moves/participants.go b/internal/moves/participants.go

index d7ccbf1bc..41ea90b83 100644

--- a/internal/moves/participants.go

+++ b/internal/moves/participants.go

@@ -1,8 +1,8 @@

package moves

import (

- "github.com/carlosframework/platform/internal/park"

"github.com/carlosframework/platform/internal/provision"

+ "github.com/carlosframework/platform/internal/regionname"

"github.com/carlosframework/platform/internal/status"

)

@@ -54,15 +54,16 @@ func ParticipantReplaced(m *provision.MoveState, boxID, instanceID string) bool

// role at all (ParticipantReplaced). No region rule applies.

// Without Participants, today's rules: source and target by placement under

-// the home binding (park.PlacementMatches), sealer by label, stager a source

+// the home binding (regionname.PlacementMatches, which park.PlacementMatches

+// is), sealer by label, stager a source

// whose label is the record's stager.

func ParticipantRole(m *provision.MoveState, boxID, instanceID, label, placement, home string) (source, target, sealer, stager bool) {

if m == nil {

return false, false, false, false

}

if m.Participants == nil {

- source = placement != "" && park.PlacementMatches(home, m.From, placement)

- target = placement != "" && park.PlacementMatches(home, m.To, placement)

+ source = placement != "" && regionname.PlacementMatches(home, m.From, placement)

+ target = placement != "" && regionname.PlacementMatches(home, m.To, placement)

sealer = label != "" && label == m.Sealer

stager = source && label != "" && label == m.Stager

return source, target, sealer, stager

diff --git a/internal/moves/participants_test.go b/internal/moves/participants_test.go

index a0a3921b4..14f1b6afa 100644

--- a/internal/moves/participants_test.go

+++ b/internal/moves/participants_test.go

@@ -3,8 +3,8 @@ package moves

import (

"testing"

- "github.com/carlosframework/platform/internal/park"

"github.com/carlosframework/platform/internal/provision"

+ "github.com/carlosframework/platform/internal/regionname"

"github.com/carlosframework/platform/internal/status"

)

@@ -31,7 +31,7 @@ func TestParticipantRoleByBoxAndInstance(t *testing.T) {

boxID, inst, label, placement string

want role

}

- home := park.HomeRegion

+ home := regionname.HomeRegion

m := ssMove()

m.Sealer = "ie-a"

// An id-less participant matches any instance of its box, never

diff --git a/internal/park/region_names.go b/internal/park/region_names.go

index f865694db..739b2cd23 100644

--- a/internal/park/region_names.go

+++ b/internal/park/region_names.go

@@ -28,9 +28,10 @@ func (e Engine) OwnsRegion(region string) bool {

func (v View) sameRegion(a, b string) bool { return SameRegion(v.HomeRegion, a, b) }

-// PlacementMatches compares a record code with a nonempty engine identity.

+// PlacementMatches compares a record code with a nonempty engine identity

+// (regionname.PlacementMatches).

func PlacementMatches(home, code, engine string) bool {

- return SameRegion(home, PlacementRegion(code), engine)

+ return regionname.PlacementMatches(home, code, engine)

}

// BoundHome joins the verified local binding and the admitted operation's

diff --git a/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv b/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

index 550e23e15..58bd3ce8a 100644

--- a/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

+++ b/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

@@ -24,7 +24,7 @@ internal/provision/offline_move.go offlineBegin legacy accepted-legacy accepted-

@coverage internal/provision 42588b9f64803b41c4463efb31e69fda0fc66573efd5d6a2d6e709682eeca385

# Task 3 (per-box reservations with a legacy projection and a sentinel, the fenced reclaim and the operator doors' bound admission), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added and no accepted-legacy unit is re-pinned, so the seal does not move. The new units (moves.ParseOfflineActive, moves.OfflineActiveBody, the console's offlinereserve.go, the doors' offlineApplyBound and offlineAdvanceBound) read no file: their reads are the bucket's control/offline-moves/active.json and the instance record through the judged readers and fenceRecord. Envelopes re-pinned in place (Task 2's rows replaced): internal/console (offlinereserve.go, the start and stage doors, the Server's two evidence fields) and internal/moves (the reservation table in offline.go).

@coverage internal/console 1f822bfe7af0fb43574bb50053474a3ef533f693cef7210434e1766c2c97ec06

-@coverage internal/moves 994b798ea9f4b582395776f27e3857339b96064fbe7637d7eeff41a0d061c200

+@coverage internal/moves 6a68b01ef865d9356bb19971f4cd4a61f7694769b63cee1d8234f615d5e9c8ba

# Task 4 (the journal, the events table, the console lease and the pass skeleton), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added. The console SQLite journal (selfserve_store.go) adds twenty-two units, each frozen accepted-legacy with a reviewed basis (console SQL as carlos-console, no bucket or root action), and the lease's console name adds one crypto/rand read (Server.selfServeConsoleID); serve (in place: the paging arm takes the store, the pass is started), NewServer (the row evidence and the recovery-mode scan) and Store.migrate (migrateSelfServe) are re-pinned. The seal moves. The lease and the pass read control/offline-moves/console.json and active.json from the bucket, not a file. Envelopes re-pinned in place: cmd/console, internal/console and internal/provision (WithWriteGuard in WriteRecord).

@legacy a8dd51a494ab3cd2ad371ded2850b6d78492569729527ea82cd8dd0f2b418a78 internal/console/selfserve_lease.go Server.selfServeConsoleID legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads crypto/rand once per process for the random console name the self-serve moves lease carries; randomness grants no root authority file:Read@110 3303b18ec5c77ccaf662064801f94276bfe947c31378cc1ecb8c4fe509d5d4d1

internal/console/selfserve_lease.go Server.selfServeConsoleID legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads crypto/rand once per process for the random console name the self-serve moves lease carries; randomness grants no root authority file:Read@110 3303b18ec5c77ccaf662064801f94276bfe947c31378cc1ecb8c4fe509d5d4d1

@@ -129,3 +129,6 @@ internal/status/snapshot.go CollectBox legacy accepted-legacy accepted-legacy;re

@coverage internal/host 8f1c08e95ae6cb5f287d7acea0bb3e7311a94f69cdbf0afd0ff4bebb21075af4

@coverage internal/lease 7e2a4a3652f964aaf1ee32356d2538a292c66ee0aaf9e622cf087b644aeaaa61

@coverage internal/status 6bf65bf3b04fdc150e2ec35d2d0d67046cf37b7c60a9dcde1c2204b75bcf8d2b

+# Task 6 fix round 1 (the import cycle internal/park's tests saw), rev3=PROPOSED-self-serve-moves-2: PlacementMatches moves into internal/regionname (park.PlacementMatches delegates to it, unchanged in behaviour) so internal/moves no longer imports internal/park; no root read is added or moved. Envelopes: internal/moves in place, internal/park and internal/regionname added.

+@coverage internal/park 778a86513bc64068b93e257c09972fbc307ebe401a125a61003f3ad26a28f611

+@coverage internal/regionname edcc0632066dc324b7df2d59a03bebcc0bf9e243bd0892fcddcfa633747977f4

diff --git a/internal/regionname/region.go b/internal/regionname/region.go

index d56e208f8..118dd95f9 100644

--- a/internal/regionname/region.go

+++ b/internal/regionname/region.go

@@ -56,3 +56,12 @@ func SameRegion(home, a, b string) bool {

return home != "" && PlacementRegion(home) == home &&

((a == home && b == HomeRegion) || (a == HomeRegion && b == home))

}

+// PlacementMatches compares a record's placement code with a nonempty engine

+// identity under the verified home binding: the code's engine region

+// (PlacementRegion) is the same region (SameRegion). park.PlacementMatches is

+// this; it lives here so a package park depends on (internal/moves) can ask

+// it without importing park.

+func PlacementMatches(home, code, engine string) bool {

+ return SameRegion(home, PlacementRegion(code), engine)