amadan
docs: cohort-1 step 5.0a done: digests on for bab, console 7c1beb2d
Re-ran 1a to 1e and the artefact check on the day of the go (all PASS), turned pointer digests on for account bab at 10:11:25Z, then shipped and promoted the prebuilt v0.28.2 console as 7c1beb2d to canary/console. Sophie adopted it at 10:11:50Z; the pointer carries digests, no row was written by an old writer, and wakecheck still serves.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+50
−0
docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md+50 −0
CI passed — run details
CI log
=== gate ===
cd launchctx && go vet ./... && go test ./... -count=1
ok amadan.net/carlos/platform.git/launchctx 0.011s
? amadan.net/carlos/platform.git/launchctx/controlname [no test files]
? amadan.net/carlos/platform.git/launchctx/wireid [no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok github.com/carlosframework/platform 294.082s
? github.com/carlosframework/platform/cmd/changelog [no test files]
ok github.com/carlosframework/platform/cmd/console 2.841s
ok github.com/carlosframework/platform/cmd/moveprobe 92.252s
ok github.com/carlosframework/platform/cmd/zddprobe 0.720s
ok github.com/carlosframework/platform/internal/activator 250.826s
ok github.com/carlosframework/platform/internal/agentsock 0.018s
ok github.com/carlosframework/platform/internal/alerting 0.007s
ok github.com/carlosframework/platform/internal/analytics 0.052s
ok github.com/carlosframework/platform/internal/appconfig 2.532s
ok github.com/carlosframework/platform/internal/apperr 0.106s
ok github.com/carlosframework/platform/internal/applog 0.169s
ok github.com/carlosframework/platform/internal/awsinv 0.006s
ok github.com/carlosframework/platform/internal/boxchoice 0.005s
ok github.com/carlosframework/platform/internal/boxid 0.721s
? github.com/carlosframework/platform/internal/boxid/boxidtest [no test files]
? github.com/carlosframework/platform/internal/boxid/internal/signtest [no test files]
ok github.com/carlosframework/platform/internal/boxvolumes 0.009s
ok github.com/carlosframework/platform/internal/caps 0.013s
ok github.com/carlosframework/platform/internal/certwarm 0.002s
ok github.com/carlosframework/platform/internal/cgroup 0.732s
ok github.com/carlosframework/platform/internal/changelog 0.317s
ok github.com/carlosframework/platform/internal/claimactivation 0.036s
ok github.com/carlosframework/platform/internal/clamd 0.057s
? github.com/carlosframework/platform/internal/cliflag [no test files]
ok github.com/carlosframework/platform/internal/console 399.895s
? github.com/carlosframework/platform/internal/controlname [no test files]
? github.com/carlosframework/platform/internal/controlsock [no test files]
ok github.com/carlosframework/platform/internal/dbdoor 6.540s
ok github.com/carlosframework/platform/internal/dbdoor/dbdoortest 0.008s
ok github.com/carlosframework/platform/internal/dbverify 0.006s
ok github.com/carlosframework/platform/internal/dnsrec 0.003s
ok github.com/carlosframework/platform/internal/docsite 0.006s
ok github.com/carlosframework/platform/internal/domains 2.466s
ok github.com/carlosframework/platform/internal/doorkey 0.008s
ok github.com/carlosframework/platform/internal/economics 0.004s
ok github.com/carlosframework/platform/internal/edge 44.786s
? github.com/carlosframework/platform/internal/edgeproof [no test files]
ok github.com/carlosframework/platform/internal/edgesfile 0.014s
ok github.com/carlosframework/platform/internal/fleetapi 0.140s
ok github.com/carlosframework/platform/internal/gate 1.669s
ok github.com/carlosframework/platform/internal/genselect 0.018s
ok github.com/carlosframework/platform/internal/geo 0.021s
ok github.com/carlosframework/platform/internal/geoip 0.039s
ok github.com/carlosframework/platform/internal/historyreadback 0.172s
ok github.com/carlosframework/platform/internal/host 173.883s
ok github.com/carlosframework/platform/internal/hostactors 0.671s
ok github.com/carlosframework/platform/internal/hostbox 2.707s
ok github.com/carlosframework/platform/internal/hostclaim 0.567s
ok github.com/carlosframework/platform/internal/hostevidence 0.005s
ok github.com/carlosframework/platform/internal/hostexec 4.772s
ok github.com/carlosframework/platform/internal/hostfence 0.036s
ok github.com/carlosframework/platform/internal/hostfiles 10.364s
ok github.com/carlosframework/platform/internal/hostfloor 0.012s
ok github.com/carlosframework/platform/internal/hostguard 1.036s
ok github.com/carlosframework/platform/internal/hostops 1.633s
? github.com/carlosframework/platform/internal/hostops/fencerelease [no test files]
ok github.com/carlosframework/platform/internal/hostops/internal/fencerelease 0.002s
ok github.com/carlosframework/platform/internal/hostquarantine 0.002s
ok github.com/carlosframework/platform/internal/hostrelocate 0.496s
ok github.com/carlosframework/platform/internal/hostresolve 0.155s
ok github.com/carlosframework/platform/internal/hostwrite 0.002s
ok github.com/carlosframework/platform/internal/infraview 0.002s
ok github.com/carlosframework/platform/internal/instancectl 5.212s
ok github.com/carlosframework/platform/internal/instanceexec 2.742s
ok github.com/carlosframework/platform/internal/instancefs 0.005s
ok github.com/carlosframework/platform/internal/instancekey 0.003s
ok github.com/carlosframework/platform/internal/instanceupdates 0.008s
ok github.com/carlosframework/platform/internal/layout 1.548s
ok github.com/carlosframework/platform/internal/lbhealth 0.003s
ok github.com/carlosframework/platform/internal/lease 9.796s
ok github.com/carlosframework/platform/internal/lease/leasetest 0.005s
ok github.com/carlosframework/platform/internal/ledger 0.010s
ok github.com/carlosframework/platform/internal/mail 0.159s
ok github.com/carlosframework/platform/internal/maintenance 0.081s
ok github.com/carlosframework/platform/internal/maintenanceexec 5.513s
ok github.com/carlosframework/platform/internal/maintenanceguard 0.076s
ok github.com/carlosframework/platform/internal/metrics 0.007s
ok github.com/carlosframework/platform/internal/moves 20.939s
ok github.com/carlosframework/platform/internal/moves/archive 0.769s
ok github.com/carlosframework/platform/internal/objstore 0.180s
ok github.com/carlosframework/platform/internal/ops 0.171s
ok github.com/carlosframework/platform/internal/park 0.208s
ok github.com/carlosframework/platform/internal/privatefile 0.004s
ok github.com/carlosframework/platform/internal/provision 16.450s
ok github.com/carlosframework/platform/internal/publicrelease 0.007s
? github.com/carlosframework/platform/internal/regionname [no test files]
ok github.com/carlosframework/platform/internal/registry 5.368s
ok github.com/carlosframework/platform/internal/relay 7.227s
ok github.com/carlosframework/platform/internal/release 21.158s
ok github.com/carlosframework/platform/internal/rollout 3.628s
ok github.com/carlosframework/platform/internal/rolloutwords 0.003s
ok github.com/carlosframework/platform/internal/rootaws 0.007s
ok github.com/carlosframework/platform/internal/rootparticipation 0.058s
ok github.com/carlosframework/platform/internal/rootstate 0.026s
ok github.com/carlosframework/platform/internal/runs 0.583s
ok github.com/carlosframework/platform/internal/s3compat 0.005s
ok github.com/carlosframework/platform/internal/safefile 0.004s
ok github.com/carlosframework/platform/internal/schedule 2.467s
ok github.com/carlosframework/platform/internal/seeds 0.011s
ok github.com/carlosframework/platform/internal/sim/hostlife 8.447s
ok github.com/carlosframework/platform/internal/sim/litestreamfacts 3.996s
ok github.com/carlosframework/platform/internal/status 0.040s
ok github.com/carlosframework/platform/internal/steering 0.009s
ok github.com/carlosframework/platform/internal/stopevidence 0.202s
ok github.com/carlosframework/platform/internal/svcrole 0.003s
ok github.com/carlosframework/platform/internal/telemetry 0.004s
ok github.com/carlosframework/platform/internal/termfence 0.003s
ok github.com/carlosframework/platform/internal/tunnelclient 0.004s
ok github.com/carlosframework/platform/internal/unixdial 0.002s
ok github.com/carlosframework/platform/internal/updatewords 0.004s
ok github.com/carlosframework/platform/internal/usage 0.004s
ok github.com/carlosframework/platform/internal/version 0.001s
ok github.com/carlosframework/platform/internal/vet 1.529s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
linux/arm64 carlos binary: 48824482 bytes (ceiling 52000000)
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
minio: cached, digest verified
mc: cached, digest verified
minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
buckets and scoped user ready
=== RUN TestDeliveredContractMinio
=== RUN TestDeliveredContractMinio/put
=== RUN TestDeliveredContractMinio/get_round-trips_the_body
=== RUN TestDeliveredContractMinio/list_shows_the_key
=== RUN TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN TestDeliveredContractMinio/delete_removes_it
=== RUN TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
--- PASS: TestDeliveredContractMinio/put (0.00s)
--- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
--- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
--- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
--- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok github.com/carlosframework/platform/internal/objstore 0.022s
=== RUN TestT4StorageProbeMinio
2026/10/18 10:20:58 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18DF988158973878, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.00s)
PASS
ok github.com/carlosframework/platform/internal/host 0.020s
minio contract: PASS
diff --git a/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md b/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md| index 131f10185..7a06626ab 100644 |
| --- a/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md |
| +++ b/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md |
| @@ -563,6 +563,8 @@ canary/console 3b69c2bd 2026-10-18T05:53:16Z no |
| Noted, not a STOP: the bucket also holds legacy account-less copies under `apps/console/`, `apps/helloworld/` and `apps/website/`, including `apps/console/channels/canary/console.json`. That pre-accounts key shape is read by no runtime path since the read fallback was retired (`internal/release/release.go`), and `digests on --account-id bab` does not touch it. |
| +Re-run on the day of the go, 2026-10-18 10:09:32Z (account `640012953448` confirmed): PASS. The same one key, and `canary/console 3b69c2bd 2026-10-18T05:53:16Z no`. |
| + |
| **1b. Every `bab` app on dev and its current channel pointers.** This is what digests on for `bab` reaches: |
| ```bash |
| @@ -592,6 +594,8 @@ The first command lists every pointer object; the loop prints, per app, each cha |
| Promotions since 2026-10-13: the console (the v0.28.1 roll), `appsdomain-check`, `rollcheck-0261`, `wakecheck`, `zdd-probe4` and `zdd-probe5`. Their writers are in 1d. |
| +Re-run on the day of the go, 2026-10-18 10:09:32Z: PASS. Nine apps, ten pointers, none with digests. The nine rows above are unchanged. The one new row is `claimtrial`, `edge`, `wc4`, promoted 2026-10-18T10:03:13Z by step 4 (the controller's session, CLI v0.28.0; the operator row in 1d). The `apps/bab/` listing has no `PRE /`, and `apps/bab//` holds 0 objects (step 2 done). |
| + |
| **1c. The dev console is on v0.28.x:** |
| ```bash |
| @@ -603,6 +607,8 @@ Pass: the header names a v0.28.x commit (`26065378` for v0.28.0, `3b69c2bd` for |
| 2026-10-18: PASS. `x-carlos-version: 3b69c2bd` (v0.28.1, held there on purpose until this step), running `/opt/carlos/versions/3b69c2bd/console`, `console.service` active. Rollback version: `3b69c2bd`. |
| +Re-run on the day of the go, 2026-10-18 10:09:54Z: PASS, unchanged. `x-carlos-version: 3b69c2bd`, running `/opt/carlos/versions/3b69c2bd/console`, active. Rollback version: `3b69c2bd`. |
| + |
| **1d. Every session or CI job that promotes into dev `bab`.** Each one is checked, and any writer older than v0.26.0 is a STOP: |
| | Writer | How it promotes | Check | 2026-10-18 | |
| @@ -618,6 +624,16 @@ Pass: the header names a v0.28.x commit (`26065378` for v0.28.0, `3b69c2bd` for |
| On DOCS-T1 the other `carlos` files found are test fixtures under `~/t/` and old release copies under `~/t/rel020/` and `~/t/rel021/`; none is on `PATH`. Ask on #250 and wait for a clear answer from each writer marked OPEN: its `carlos version` is v0.26.0 or later, or it will not promote on dev until this step is done. The go needs every row PASS. |
| +Re-run on the day of the go, 2026-10-18 10:10Z. Every row PASS. The answers from other writers were gathered by the controller before the go and passed to the agent running this step; the agent re-checked the console, operator and box rows itself: |
| +- The dev console: PASS, v0.28.1 (1c re-run). |
| +- Operator sessions on DOCS-T1: PASS. `"$CARLOS" version` is `carlos v0.28.2`, the sha256 of `carlos-linux-amd64` is `303f6522…9a808`, and the signature and sums verified. `which -a carlos` lists only `~/.local/bin/carlos`, `carlos v0.28.0`. The old `~/bin/carlos` (`carlos v0.17.0`) was renamed to `~/bin/carlos.v0.17.0-retired`, with Paul's approval, and is no longer on `PATH` as `carlos`. |
| +- platform-1e: PASS. Its CLI is v0.28.x, and it does not promote during 5.0a. |
| +- platform-d8 (H2): PASS. It has never promoted on dev. |
| +- platform-f9: PASS. Its CLIs are v0.27.x, and its zdd probes are trashed. The `zdd-probe4` and `zdd-probe5` pointers are still in the bucket (1b), with no promote since 2026-10-14. |
| +- Whoever ships `appsdomain-check`, `rollcheck-0261` and `wakecheck`, and any other credential holder: PASS, on the controller's word that the writer checks are complete. No other writer was named. |
| +- Box CLIs: PASS. leo, sophie and dennis are all `carlos v0.28.2`, with `.prev` at `carlos v0.28.1` (re-read over SSM at 10:10Z). |
| +- CI: PASS. No CI job touches dev `bab`. |
| + |
| **1e. The digest state before:** |
| ```bash |
| @@ -629,6 +645,8 @@ Expected: `pointer digests: off for bab`, then a table of the `bab` channels wit |
| 2026-10-18: as expected. `pointer digests: off for bab`, all nine pointers of 1b listed with `no`, and no `releases/bab/pointer-digests` object. |
| +Re-run on the day of the go, 2026-10-18 10:10:15Z: as expected, PASS. `pointer digests: off for bab`, all ten pointers of the 1b re-run listed with `no` (now including `claimtrial`), and no marker object (`aws s3 ls` exit 1). |
| + |
| **2. Check the prebuilt console (local, read-only; never execute or rebuild it):** |
| ```bash |
| @@ -652,6 +670,8 @@ Expected, as read on 2026-10-18 (PASS): |
| The stamp is the release tag exactly once, the file is stripped (main's bounded ELF check refuses an unstripped build's compressed debug sections), the main package is `cmd/console` (not the CLI), and its sha256 is not a file in the release's sums. A different sha256 on the day is a STOP. |
| +Re-run on the day of the go, 2026-10-18 10:10Z: PASS. The output matches the block above line for line: sha256 `0827341051360e888ed4f6df568a77ebb070e6ad16a7c87a2947a02dbd552ff4`, stripped aarch64, `cmd/console`, `Build=v0.28.2` once, and `0` in `SHA256SUMS.txt`. |
| + |
| **3. Turn digests on for `bab`.** The step's one go covers 3 and 4 together. |
| ```bash |
| @@ -691,6 +711,36 @@ Rollback: |
| Then check `x-carlos-version` and the `readlink` as in 1c. `carlos channels digests off` is only for a broken writer (README), and it does not clear boxes that have already seen digests. A rollback after 4 means the signing session cannot start: `publish-identity` needs the v0.28.2-stamped console running. |
| +**2026-10-18, done: PASS.** Run by an agent on the controller's instruction, after Paul's go for this step. Dev only; no host.env edit, no flag, no claim change, and the signing session was not started. The checks in 1a to 1e and 2 were re-run first, 10:09Z to 10:11Z, and all passed (results under each check). `apps/bab/console/releases/7c1beb2d/` was absent at 10:11:10Z. The CLI was `carlos-linux-amd64` v0.28.2, sha256 `303f6522…9a808`; the signature verified and so did `sha256sum -c`. `release.pub` holds the key given in the values above. |
| + |
| +- **3, 10:11:23Z.** The release key was read from SSM inline and never printed. Output, verbatim: |
| + |
| + ``` |
| + pointer digests on for bab. Upgraded writers sign digests from now on |
| + pointer digests: on for bab since 2026-10-18T10:11:25Z |
| + ``` |
| + |
| + The table that followed matched 1e: ten rows, all `no`. The marker `releases/bab/pointer-digests` (219 bytes) was written at 10:11:26Z. |
| +- **4, 10:11:35Z to 10:11:48Z.** `CARLOS_BIN=$CARLOS .../platform-infrastructure/scripts/ship-app.sh kass carlos-dev-640012953448 console 7c1beb2d canary/console binary ~/.cache/release-v0.28.2/console-linux-arm64`. Direct-bucket mode with no `--account-id`, so the default account `ops` resolved to `bab` (`resolveAccount`). Output: |
| + |
| + ``` |
| + shipped console 7c1beb2d (1 artifacts) |
| + promoted console 7c1beb2d -> canary/console |
| + ``` |
| + |
| + The manifest reads `built_by carlos v0.28.2`, program `cmd/console`, `linux-arm64` sha256 `0827341051360e888ed4f6df568a77ebb070e6ad16a7c87a2947a02dbd552ff4`, size 47055010. On sophie at 10:11:48Z, the agent asked for a root pass (`open directory /opt/carlos/versions/7c1beb2d: read-only file system`, the same path as wc4 in step 4). `console.service` restarted at 10:11:49Z, then the log said `adopt: ... console.service settled on /opt/carlos/versions/7c1beb2d` and `updated 3b69c2bd -> 7c1beb2d (canary/console)` at 10:11:50Z. The new header was already served at 10:11:54Z. |
| + |
| +Verification, 10:12:02Z to 10:12:31Z, all PASS: |
| +- `x-carlos-version: 7c1beb2d`, HTTP 200. |
| +- Sophie runs `/opt/carlos/versions/7c1beb2d/console`; `console.service` is active (since 10:11:49Z), and the file's sha256 on the box is `0827341051360e888ed4f6df568a77ebb070e6ad16a7c87a2947a02dbd552ff4`. |
| +- `"$CARLOS" channels --app console --account-id bab` shows `canary/console 7c1beb2d 2026-10-18T10:11:48Z yes`. |
| +- `channels digests --account-id bab` shows `pointer digests: on for bab since 2026-10-18T10:11:25Z` and nine rows, all `no`. `console canary/console` is gone, and no row says `written after digests were turned on`. |
| +- wakecheck through DNS: `wakecheck build=wc4 host=ip-172-31-14-16 ... hits=1039`, HTTP 200, 0.20 s to first byte (sophie). |
| +- The console pages answer: `/` is the sign-in page (200), and `/healthz` returns 200. |
| +- Noted, not new: the restarted console logs `ce:GetCostAndUsage` AccessDenied (the dev host role has no Cost Explorer access, so bill pulls are off). The 3b69c2bd console logged the same denial twice before this step. |
| + |
| +The rollback version, if one is ever needed, is `3b69c2bd`, promoted with digests on as described under "After 4". None was needed. This step's precondition for the signing session is met. Opening the session needs its own go, and its CloudTrail window starts after this step's last read at 10:12Z. |
| + |
| ## The signing session: 5.1, 6 and 7 |
| Paul's ruling, 2026-10-18: the trusted signing host is created once, after v0.28.2 is on dev, for one session that covers 5.1, step 6 and step 7, so the release key is on a host only once. The trial waits for v0.28.2 before anything past 5.0. |