amadan
List each approval with its exact scope; refresh the short handoff for the gated tip 3d4104cb
Documents only.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2 files changed,
+23
−7
.claude/HANDOFF.md+7 −7implementation/carloku-paid-launch/OUTSTANDING.md+16 −0
CI passed — run details
diff --git a/.claude/HANDOFF.md b/.claude/HANDOFF.md| index ecc2bd5ff..24fa60669 100644 |
| --- a/.claude/HANDOFF.md |
| +++ b/.claude/HANDOFF.md |
| @@ -7,24 +7,24 @@ |
| Get Carloku's paid plans live with Stripe Tax and the complete metered model; have the pricing page and signup flow reviewable in the morning. |
| **STATUS:** |
| -Reviewable, not production-ready. `implementation/carloku-paid-launch/OUTSTANDING.md` is the list: what is reviewable, what is tested, what is proven, and every launch blocker. Billing is OFF, the quantity worker is OFF (two switches, both unset), nothing attests, nothing was deployed, and no live Stripe or AWS write was made. |
| +Three things, kept apart. (1) Draft copy to review, not approved: pricing http://docs-t1.tail5fd3ba.ts.net:38009 (fallback http://100.119.180.57:38009), console billing page http://docs-t1.tail5fd3ba.ts.net:45033 (fallback http://100.119.180.57:45033). (2) A demo to click through: http://100.119.180.57:41881, real console handlers with Keymail and Stripe simulated; not Stripe proof. (3) A tested branch that is not production-ready: `implementation/carloku-paid-launch/OUTSTANDING.md` says what is reviewable, tested and proven, lists every launch blocker, and lists each approval to ask for with its exact scope. All three review servers answered 200 on the IP form at 06:12 Dublin on 2026-10-01. |
| -Code tip `c3e87a94`. Full gate on it: go build, go vet, gofmt, `make test` with 61 packages ok (`logs/gate-c3e87a94.txt` in the run directory); cross builds for darwin, linux arm64 and windows pass (`logs/cross-c3e87a94.txt`). Any commit after `c3e87a94` on this branch is documents only unless this file says otherwise. The forge has `b6692549`; the hub's `carlos/platform` repository answers 500 on and off (it took a push at 05:22 Dublin and refused again at 05:45), so newer commits are in bundles in the run directory and a retry loop is pushing. Amadan CI was queued on `b6692549` and has not been read complete on any tip since `6a0c99d8`. |
| +Billing is OFF, the quantity worker is OFF (two switches, both unset), nothing attests, nothing was deployed, and no live Stripe or AWS write was made. |
| -Independent review: GPT-6 Astra rejected rounds 1 to 7; the AGENTS-required Opus production review accepted with fixes in rounds 2 to 7. Round seven's findings (the lease's scope, the fence's reach, what a held Stripe key means) are all accepted and fixed with reproductions and mutation checks. Round eight of both is running against `c3e87a94` (run directory `logs/astra-review8.md`, `logs/opus-review8.md`). Nothing lands until it passes. Dispositions: `docs/superpowers/specs/CODEX-DISPOSITIONS-carloku-paid-launch-overnight.md`. |
| +Code tip `3d4104cb`, on the forge. Full gate on it: go build, go vet, gofmt, `make test` with 61 packages ok (`logs/gate-3d4104cb.txt` in the run directory); cross builds for darwin, linux arm64 and windows pass (`logs/cross-3d4104cb.txt`). Any commit after `3d4104cb` on this branch is documents only unless this file says otherwise. Amadan CI was queued on the pushed tip at 06:12 and had not finished when last read; the hub's `carlos/platform` repository answered 500 on and off all night. |
| -Two open defects, both with their paths disabled, neither offered as a risk to accept: a quantity request that runs after Stripe has forgotten its key, and a late invoice-line request that can leave a finalized invoice with a wrong total a customer could pay. The design that removes both (a request cannot outlive its connection) is `docs/superpowers/plans/2026-10-01-late-request-fencing.md`, begun on `feat/carloku-late-request-fencing-20261001` (`3be871db`, not gated, not reviewed). |
| +Independent review: GPT-6 Astra rejected rounds 1 to 8 (the last three found fourteen, nine and five); the AGENTS-required Opus production review accepted with fixes in rounds 2 to 8. Round eight is fixed with reproductions and mutation checks, except two findings recorded as accepted and open. Round nine of both runs against `f5538467` (the same code plus its brief): run directory `logs/astra-review9.md`, `logs/opus-review9.md`. Nothing lands until a round passes. Dispositions: `docs/superpowers/specs/CODEX-DISPOSITIONS-carloku-paid-launch-overnight.md`. |
| -Scoped replication attestation (path A) cannot prove an exclusive writer and is off this branch, parked on `feat/carloku-scoped-attestation-20261001` (pushed). Replication-write completeness is a launch blocker, not waived. |
| +Two open defects, both with their paths disabled, neither offered as a risk to accept: a quantity request that runs after Stripe has forgotten its key, and a late invoice-line request that can leave a finalized invoice with a wrong total a customer could pay. The design that removes both is `docs/superpowers/plans/2026-10-01-late-request-fencing.md`, built so far on `feat/carloku-late-request-fencing-20261001` (`833a403c`, pushed, not gated, not reviewed). That branch also voids a wrong-total invoice; that is remediation, and its limits are pinned by tests there. |
| -Review servers on docs-t1, each answering 200 on its IP form at 05:06 Dublin time on 2026-10-01: pricing http://docs-t1.tail5fd3ba.ts.net:38009 (fallback http://100.119.180.57:38009), console billing page http://docs-t1.tail5fd3ba.ts.net:45033 (fallback http://100.119.180.57:45033), signup and billing demo http://100.119.180.57:41881 (Keymail and Stripe simulated; not Stripe proof). |
| +Scoped replication attestation (path A) cannot prove an exclusive writer and is off this branch, parked on `feat/carloku-scoped-attestation-20261001` (pushed). Replication-write completeness is a launch blocker, not waived. A code map and plan for path B is in the run directory, `notes/path-b-replicator-code-map.md`. |
| **NEEDED:** |
| - Paul: approve or edit both copy reviews; confirm the HALF code word; decide the proration policy; approve or change the whole-paid-day rule for partial months; rule on a store's first clock hour and a box's first minutes; review member copy for a bucket retained by another account. |
| - Scoped approvals, prepared as plans only: the `rk_live` restricted key and Stripe catalog; the Cost and Usage Report export; Stripe test mode, to run `TestSandboxQuantityFence` and confirm the provider's treatment of a proration date. |
| **RECOMMENDED:** |
| -- Read round eight, fix what it finds, re-review the exact tip. Push when the repository answers and read CI on that tip. |
| +- Read round nine, fix what it finds, re-review the exact tip. Read CI on that tip. |
| - Finish the late-request design on its branch (the invoice engine's void on a failed verification, the idle measurement in the sandbox test), then review it. |
| - Then, each on its own branch: path B of the attestation plan, quantity reduction at renewal, the AWS principal inventory and the bucket ownership attestation door, Free-tier enforcement, dormancy and pool accounting (none started). |
| - Find what moved 1,395 GB out of Ireland to three other regions in September (collector plan). |
diff --git a/implementation/carloku-paid-launch/OUTSTANDING.md b/implementation/carloku-paid-launch/OUTSTANDING.md| index af2092257..c28f8def1 100644 |
| --- a/implementation/carloku-paid-launch/OUTSTANDING.md |
| +++ b/implementation/carloku-paid-launch/OUTSTANDING.md |
| @@ -63,6 +63,22 @@ Each is concrete. None is waived. |
| 20. **The branch tip is not on the forge.** From 03:30 on 2026-10-01 the hub's `carlos/platform` repository answered 500 or 502 after a ten-second wait, to reads and pushes alike, while the hub's front page and other repositories answered. Bundles are in the run directory. Amadan CI has not run on the tip. |
| 21. **A scanner backend that calls a provider must be fenced like the walks.** Today's scanner (ClamAV) makes no provider call at teardown. A native one would, and its client would need the fenced signer. |
| +## Approvals to ask for, each with its exact scope |
| + |
| +Nothing below was assumed overnight. None of it has been done. |
| + |
| +| # | Approval | Exact scope | What it unblocks | |
| +| --- | --- | --- | --- | |
| +| A | Copy | The two reviews as they stand at the URLs above (87 and 40 strings), the HALF code word, and member copy for the three store walk refusals | Applying copy byte for byte; nothing ships with unapproved copy | |
| +| B | Proration policy | One of `immediate` or `next_invoice` | Half of what the quantity worker needs. It does not start on this alone | |
| +| C | Partial-month usage rule | Bill only UTC days wholly inside a paid span (`docs/superpowers/plans/2026-10-01-partial-month-billing.md`), or the alternative there | The first invoice of any subscriber who joins mid-month | |
| +| D | Two rulings | A store's partial first hour, and a box's first minutes before its ledger opened: operator release, or the platform absorbs them | Months that otherwise hold for good | |
| +| E | Stripe test mode | One `rk_test_` restricted key with write on customers, payment methods, products, prices and subscriptions and read on invoices; permission to create and cancel test objects in the sandbox | Running `TestSandboxQuantityFence` under both policies (about ten minutes, plus a six-minute idle measurement on the fencing branch). Required before `CONSOLE_BILLING_QUANTITY_FENCE` is set | |
| +| F | Stripe live provisioning | Products, prices, portal configuration, webhook endpoint and an `rk_live_` runtime key, exactly as `stripe-provisioning.md` lists them | A test purchase, then a real one. After A | |
| +| G | AWS, read-write, scoped | Create the Cost and Usage Report data export in the collector plan. Separately: write, conditionally delete and remove one scratch object in the deployment bucket, to check that S3 honours `If-Match` on a delete (item 19c) | The store transfer meter's source; the conditional delete the store walks rely on | |
| +| H | Box change | Path B: replace the external replicator with the platform's own on a dev box, including which user holds the replica credentials | The replication meter. Needs building first | |
| +| I | Merge | None requested. No review round has passed | | |
| + |
| ## Tested on this branch, not proven |
| - Store walks (grant, teardown, rotation): a lease per bucket name across processes (per app when there is no usable name), the record re-read under it and required to be the same estate, every request to S3, IAM and the deployment bucket stamped with the lease instant (checked on the production constructors against a local server), deletes conditional on the generation read, the name held if any request needed a second attempt. The app purge never sweeps a store record it did not read as a bare declaration. The walks themselves have run only against the in-memory provisioner and a directory store. The simulation covers sequential walks, walks frozen past their lease while another takes the name, walks held before their lease while the store is replaced, and failures before and after the effect. It does not cover a second bucket name, rotations, stores with no ledger interval, or clocks that disagree; those have one direct test each. |