carlos / platform Public

Refresh the short handoff and the outstanding list for the gated tip

Documents only. The code tip is 43383b93: full gate and cross builds pass on
it, and round seven of both reviewers runs against it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

claude 3 weeks ago 6d377c869d8a7bca412a721a158c3dc4a8fe74e6 parent 43383b9

2 files changed, +17 −8

.claude/HANDOFF.md +15 −7
implementation/carloku-paid-launch/OUTSTANDING.md +2 −1

diff --git a/.claude/HANDOFF.md b/.claude/HANDOFF.md

index 185794577..d6e073be2 100644

--- a/.claude/HANDOFF.md

+++ b/.claude/HANDOFF.md

@@ -7,17 +7,25 @@

Get Carloku's paid plans live with Stripe Tax and the complete metered model; have the pricing page and signup flow reviewable in the morning.

**STATUS:**

-The exact tip, its gate result and its CI result are in the Amadan branch handoff, which is rewritten at each checkpoint; this file names what the work is. Independent review: GPT-6 Astra rejected rounds 1 to 5 (ten, eight, five, five, eleven findings); the AGENTS-required Opus production review accepted with fixes in rounds 2 to 5 (eight, eight, eight, nine). Every finding was accepted and fixed with a reproduction (`docs/superpowers/specs/CODEX-DISPOSITIONS-carloku-paid-launch-overnight.md`). Round six runs against the tip; nothing lands until it passes. Landed in this run: console GET billing page, signup and billing demo harness, durability epoch race fix, unmetered-fallback escapes, AWS Cost and Usage Report transfer collector with bucket ownership ledger, statement folds for both new meters, partial-month billing on whole paid days, operator doors for review holds and the house marker, team quantity worker behind an unset policy switch, a teardown that never destroys a bucket another app holds and refuses grants of a name while it is being destroyed, a scoped replication attestation built end to end behind an agent switch that is off, Stripe provisioning plan and print-only script. Review servers on docs-t1, each answering 200 on its IP form at 01:50 Dublin time on 2026-10-01: pricing http://docs-t1.tail5fd3ba.ts.net:38009 (fallback http://100.119.180.57:38009), console billing page http://docs-t1.tail5fd3ba.ts.net:45033 (fallback http://100.119.180.57:45033), signup and billing demo http://100.119.180.57:41881. The tailnet hostname was not verified from this box. Billing is OFF. No AWS, Stripe or production change was made; AWS was read once (one Cost Explorer query and two list calls on the flagship account).

+Reviewable, not production-ready. `implementation/carloku-paid-launch/OUTSTANDING.md` is the list: what is reviewable, what is tested, what is proven, and every launch blocker. Billing is OFF, the quantity worker is OFF, nothing attests, nothing was deployed, and no live Stripe or AWS write was made.

+Code tip `43383b93` (local; origin is still `6a0c99d8` because the hub's `carlos/platform` repository has answered 500 or 502 after a ten-second wait since 03:30 Dublin on 2026-10-01, while the rest of the hub answers; bundles are in the run directory). Full gate on `43383b93`: go build, go vet, gofmt, `make test` with 60 packages ok (`logs/gate-43383b93.txt`); cross builds for darwin, linux arm64 and windows pass (`logs/cross-43383b93.txt`). Amadan CI has not run on it. Any commit after `43383b93` on this branch is documents only unless this file says otherwise.

+Independent review: GPT-6 Astra rejected rounds 1 to 6; the AGENTS-required Opus production review accepted with fixes in rounds 2 to 6. Round seven of both is running against `43383b93` (run directory `logs/astra-review7.md`, `logs/opus-review7.md`). Nothing lands until it passes. Dispositions: `docs/superpowers/specs/CODEX-DISPOSITIONS-carloku-paid-launch-overnight.md`.

+What round six changed: bucket-name walks take a cross-process lease and are fenced at AWS by the request's signing time (checked read-only against S3 and IAM); the quantity worker has a send lease and a provider-side key fence that is unverified against Stripe and lasts only as long as Stripe remembers a key, so it has a second switch that waits on a sandbox test; scoped replication attestation (path A) cannot prove an exclusive writer and is off this branch, parked on `feat/carloku-scoped-attestation-20261001`; replication-write completeness is a launch blocker, not waived.

+Review servers on docs-t1, each answering 200 on its IP form at 04:32 Dublin time on 2026-10-01: pricing http://docs-t1.tail5fd3ba.ts.net:38009 (fallback http://100.119.180.57:38009), console billing page http://docs-t1.tail5fd3ba.ts.net:45033 (fallback http://100.119.180.57:45033), signup and billing demo http://100.119.180.57:41881 (Keymail and Stripe simulated; not Stripe proof).

**NEEDED:**

-- Paul: approve or edit both copy reviews; confirm the HALF code word; decide the proration policy (`CONSOLE_BILLING_PRORATION` stays unset until then); approve or change the whole-paid-day rule for partial months (`docs/superpowers/plans/2026-10-01-partial-month-billing.md`, "What the approved spec says").

-- Scoped approvals, prepared as plans only: the rk_live restricted key and Stripe catalog (`implementation/carloku-paid-launch/stripe-provisioning.md`); the Cost and Usage Report export (`docs/superpowers/plans/2026-10-01-store-transfer-cur-collector.md`); Stripe test mode, to confirm how the provider treats a proration date outside the current period.

-- A decision on a store's first clock hour: an operator release for a held bucket-hour, or the platform absorbs it (collector plan).

+- Paul: approve or edit both copy reviews; confirm the HALF code word; decide the proration policy; approve or change the whole-paid-day rule for partial months; rule on a store's first clock hour and a box's first minutes; review member copy for a bucket retained by another account.

+- Scoped approvals, prepared as plans only: the `rk_live` restricted key and Stripe catalog; the Cost and Usage Report export; Stripe test mode, to run `TestSandboxQuantityFence` and confirm the provider's treatment of a proration date.

+- A decision on the fence's limit: a request frozen for more than a day is detected and held, not prevented.

**RECOMMENDED:**

-- Read the round-five reviews, fix what they find, re-review the exact tip.

-- Then: the AWS principal inventory and the bucket ownership attestation door, quantity reduction at renewal, a `carlos` verb and docs for the operator doors, Free-tier enforcement, dormancy and pool accounting (none started).

-- Find what moved 1,395 GB out of Ireland to three other regions in September (collector plan); it is the largest S3 transfer line on the account and grew forty-fold in a month.

+- Read round seven, fix what it finds, re-review the exact tip. Push when the repository answers and read CI on that tip.

+- Then, each on its own branch: path B of the attestation plan, quantity reduction at renewal, the AWS principal inventory and the bucket ownership attestation door, Free-tier enforcement, dormancy and pool accounting (none started).

+- Find what moved 1,395 GB out of Ireland to three other regions in September (collector plan).

**SESSION:**

Not safe to close: three servers are serving on this box (pids and stop file under `/home/paulca/.local/share/carloku-paid-launch-20260930/logs`), and two review processes may still be running.

diff --git a/implementation/carloku-paid-launch/OUTSTANDING.md b/implementation/carloku-paid-launch/OUTSTANDING.md

index 1b4142146..962e98c0c 100644

--- a/implementation/carloku-paid-launch/OUTSTANDING.md

+++ b/implementation/carloku-paid-launch/OUTSTANDING.md

@@ -55,7 +55,8 @@ Each is concrete. None is waived.

### Process

19. **Round seven review has not passed.** Astra rejected rounds one to six. The lease, fence and simulation work since round six is unreviewed.

-20. **The branch tip is not on the forge.** The Amadan hub answered HTTP 500 to every push from 03:30. Bundles are in the run directory. Amadan CI has not run on the tip.

+20. **The branch tip is not on the forge.** From 03:30 on 2026-10-01 the hub's `carlos/platform` repository answered 500 or 502 after a ten-second wait, to reads and pushes alike, while the hub's front page and other repositories answered. Bundles are in the run directory. Amadan CI has not run on the tip.

+21. **A scanner backend that calls a provider must be fenced like the walks.** Today's scanner (ClamAV) makes no provider call at teardown. A native one would, and its client would need the fenced signer.

## Tested on this branch, not proven