carlos / platform Public

docs: cohort-1 step 6: identity published, guard-arm STOP on leo's v0.28.1 .prev, session closed

6.1 passed: policy.json dfac87e6 (writes nothing), identity
control/system/router/releases/v0.28.2.json published as 2d22f05f, every
field as expected. 6.2 guard-arm on leo refused with "hostfloor:
authenticated floor required": guard-arm checks /opt/carlos/carlos.prev
against the identity, and leo's .prev is still v0.28.1. Nothing was
written on leo. The signing session was closed in full: key shredded,
signer terminated, exchange emptied, role, profile and SG deleted;
CloudTrail shows the one key fetch only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 1 week ago 72b5ab3e96a833f8ce0a71a2d94f72dc6f0b2b10 parent 102b1a1

1 file changed, +22 −3

docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md +22 −3

CI passed — run details

CI log

=== gate ===
cd launchctx && go vet ./... && go test ./... -count=1
ok  	amadan.net/carlos/platform.git/launchctx	0.012s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok  	github.com/carlosframework/platform	315.200s
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	3.099s
ok  	github.com/carlosframework/platform/cmd/moveprobe	93.194s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.719s
ok  	github.com/carlosframework/platform/internal/activator	251.703s
ok  	github.com/carlosframework/platform/internal/agentsock	0.025s
ok  	github.com/carlosframework/platform/internal/alerting	0.007s
ok  	github.com/carlosframework/platform/internal/analytics	0.022s
ok  	github.com/carlosframework/platform/internal/appconfig	2.555s
ok  	github.com/carlosframework/platform/internal/apperr	0.121s
ok  	github.com/carlosframework/platform/internal/applog	0.183s
ok  	github.com/carlosframework/platform/internal/awsinv	0.008s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.006s
ok  	github.com/carlosframework/platform/internal/boxid	0.697s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.010s
ok  	github.com/carlosframework/platform/internal/caps	0.013s
ok  	github.com/carlosframework/platform/internal/certwarm	0.004s
ok  	github.com/carlosframework/platform/internal/cgroup	0.730s
ok  	github.com/carlosframework/platform/internal/changelog	0.326s
ok  	github.com/carlosframework/platform/internal/claimactivation	0.038s
ok  	github.com/carlosframework/platform/internal/clamd	0.064s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
ok  	github.com/carlosframework/platform/internal/console	407.955s
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	5.837s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.010s
ok  	github.com/carlosframework/platform/internal/dbverify	0.006s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.003s
ok  	github.com/carlosframework/platform/internal/docsite	0.006s
ok  	github.com/carlosframework/platform/internal/domains	2.454s
ok  	github.com/carlosframework/platform/internal/doorkey	0.007s
ok  	github.com/carlosframework/platform/internal/economics	0.005s
ok  	github.com/carlosframework/platform/internal/edge	45.070s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.009s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.141s
ok  	github.com/carlosframework/platform/internal/gate	1.659s
ok  	github.com/carlosframework/platform/internal/genselect	0.019s
ok  	github.com/carlosframework/platform/internal/geo	0.011s
ok  	github.com/carlosframework/platform/internal/geoip	0.033s
ok  	github.com/carlosframework/platform/internal/historyreadback	0.183s
ok  	github.com/carlosframework/platform/internal/host	177.465s
ok  	github.com/carlosframework/platform/internal/hostactors	0.531s
ok  	github.com/carlosframework/platform/internal/hostbox	2.782s
ok  	github.com/carlosframework/platform/internal/hostclaim	0.557s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.005s
ok  	github.com/carlosframework/platform/internal/hostexec	4.822s
ok  	github.com/carlosframework/platform/internal/hostfence	0.039s
ok  	github.com/carlosframework/platform/internal/hostfiles	10.409s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.014s
ok  	github.com/carlosframework/platform/internal/hostguard	1.005s
ok  	github.com/carlosframework/platform/internal/hostops	1.662s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.002s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.002s
ok  	github.com/carlosframework/platform/internal/hostrelocate	0.468s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.141s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.002s
ok  	github.com/carlosframework/platform/internal/infraview	0.005s
ok  	github.com/carlosframework/platform/internal/instancectl	5.214s
ok  	github.com/carlosframework/platform/internal/instanceexec	2.743s
ok  	github.com/carlosframework/platform/internal/instancefs	0.005s
ok  	github.com/carlosframework/platform/internal/instancekey	0.002s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.006s
ok  	github.com/carlosframework/platform/internal/layout	1.569s
ok  	github.com/carlosframework/platform/internal/lbhealth	0.003s
ok  	github.com/carlosframework/platform/internal/lease	9.816s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.006s
ok  	github.com/carlosframework/platform/internal/ledger	0.013s
ok  	github.com/carlosframework/platform/internal/mail	0.164s
ok  	github.com/carlosframework/platform/internal/maintenance	0.086s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	5.521s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.068s
ok  	github.com/carlosframework/platform/internal/metrics	0.005s
ok  	github.com/carlosframework/platform/internal/moves	21.000s
ok  	github.com/carlosframework/platform/internal/moves/archive	0.815s
ok  	github.com/carlosframework/platform/internal/objstore	0.167s
ok  	github.com/carlosframework/platform/internal/ops	0.169s
ok  	github.com/carlosframework/platform/internal/park	0.200s
ok  	github.com/carlosframework/platform/internal/privatefile	0.003s
ok  	github.com/carlosframework/platform/internal/provision	17.215s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.006s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	5.415s
ok  	github.com/carlosframework/platform/internal/relay	7.232s
ok  	github.com/carlosframework/platform/internal/release	21.519s
ok  	github.com/carlosframework/platform/internal/rollout	3.655s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.004s
ok  	github.com/carlosframework/platform/internal/rootaws	0.007s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.058s
ok  	github.com/carlosframework/platform/internal/rootstate	0.027s
ok  	github.com/carlosframework/platform/internal/runs	0.564s
ok  	github.com/carlosframework/platform/internal/s3compat	0.005s
ok  	github.com/carlosframework/platform/internal/safefile	0.004s
ok  	github.com/carlosframework/platform/internal/schedule	2.506s
ok  	github.com/carlosframework/platform/internal/seeds	0.010s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	8.928s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	4.099s
ok  	github.com/carlosframework/platform/internal/status	0.037s
ok  	github.com/carlosframework/platform/internal/steering	0.006s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.203s
ok  	github.com/carlosframework/platform/internal/svcrole	0.002s
ok  	github.com/carlosframework/platform/internal/telemetry	0.004s
ok  	github.com/carlosframework/platform/internal/termfence	0.005s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.004s
ok  	github.com/carlosframework/platform/internal/unixdial	0.003s
ok  	github.com/carlosframework/platform/internal/updatewords	0.004s
ok  	github.com/carlosframework/platform/internal/usage	0.005s
ok  	github.com/carlosframework/platform/internal/version	0.002s
ok  	github.com/carlosframework/platform/internal/vet	1.547s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
linux/arm64 carlos binary: 48824482 bytes (ceiling 52000000)
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
  minio: cached, digest verified
  mc: cached, digest verified
  minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
  buckets and scoped user ready
=== RUN   TestDeliveredContractMinio
=== RUN   TestDeliveredContractMinio/put
=== RUN   TestDeliveredContractMinio/get_round-trips_the_body
=== RUN   TestDeliveredContractMinio/list_shows_the_key
=== RUN   TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN   TestDeliveredContractMinio/delete_removes_it
=== RUN   TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
    --- PASS: TestDeliveredContractMinio/put (0.00s)
    --- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
    --- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
    --- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
    --- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
    --- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok  	github.com/carlosframework/platform/internal/objstore	0.024s
=== RUN   TestT4StorageProbeMinio
2026/10/18 10:39:19 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18DF9981BEA6B5E9, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.01s)
PASS
ok  	github.com/carlosframework/platform/internal/host	0.022s
minio contract: PASS

diff --git a/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md b/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md

index e3d373294..86583ad10 100644

--- a/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md

+++ b/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md

@@ -28,9 +28,9 @@ Prepared on 2026-10-18 for platform-1e to present. v0.28.2 is published (tag on

| 3 | 5.0a: pointer digests on for all of `bab` on dev (eight apps, nine pointers), then ship and promote the prebuilt console `7c1beb2d` to `canary/console` | one go for both; outside any roll | 1a PASS, 1b listed, 1c PASS, 1d STOP and OPEN rows, 1e as expected, prebuilt console PASS |

| 4 | Open the signing session: create the signer host and its role policy, with read on `apps/bab/console/*` and write on exactly `control/system/router/releases/v0.28.2.json` (`signing-host.md`) | one go for host and policy together | DONE 2026-10-18: `SG` `sg-08c374c8c31ef448a`, `I` `i-0ea2852ef727929bb`, run-id `cohort1-20261018T101832Z`, session start 10:19:37Z |

| 5 | 5.1 roster and enrollment | Paul's go | DONE 2026-10-18: roster revision 5 (leo, sophie, `dev-console`), inputs staged on both boxes; token generated on the signer, never printed |

-| 6 | Step 6: sign the policy, publish the identity, arm leo, re-run P9, install the protected console, arm sophie, start the guarded console | Paul's go; restarts the dev console | P9 PASS today (09:13Z); re-run at 6.3 |

+| 6 | Step 6: sign the policy, publish the identity, arm leo, re-run P9, install the protected console, arm sophie, start the guarded console | Paul's go; restarts the dev console | 2026-10-18: 6.1 PASS (identity published, `2d22f05f`); 6.2 STOP: leo's `carlos.prev` is v0.28.1 and `guard-arm` refuses it; 6.3 not run; session closed |

-| 8 | Close the session: shred the key, terminate the signer, delete its role, profile and security group, CloudTrail check | none; always allowed | |

Later, each with its own go and outside this package: 7a.2 (fence-writer credentials), step 8 (leo's offline window), steps 9 and 10.

@@ -936,7 +936,7 @@ Final `refresh`: revision 5, etag `f3717d8d67f496ffd9525704c7a690b0`. `inspect.j

Staging from DOCS-T1: `ok` for both directories, then `staged` for leo's `release.pub` and `leo-climbing-enrollment.json`, and for sophie's `release.pub`, `sophie-knitting-enrollment.json` and `console-id` (`dev-console`). A read-only check found each one root:root `600`, link count 1, its sha256 matching, in a root `700` `/root/claim-trial`. No host.env or flag was changed on any box.

-The signer stays up with the key in tmpfs for step 6.

+The signer stayed up with the key in tmpfs for step 6. It was closed at the 6.2 stop (see the end of step 6).

## Step 6. Arm leo's guard and start the guarded console

@@ -1080,6 +1080,25 @@ Leo's host claims stay off until step 8. Get real fresh box evidence from both e

On failure: hold. Arming is one-way: keep the local armed policy, and never delete the enrollment or the guard. Restore only an image at or above the floor. Never delete or rewrite the published identity, `policy.json`, `identity.json` or the files in `/opt/carlos/system/console/`.

+**2026-10-18: 6.1 PASS; 6.2 STOP. The session is closed.** Run by the executor on Paul's go for step 6, relayed by the controller. Commands went over SSM, as in 5.1.

+Before 6.1: `/usr/local/bin/carlos system claims help` on the signer matched the three changes quoted under "The signing session" exactly: `run ... [--out FILE]`, `install-console` between `console-report` and `install-control`, and the `--out` line last. `SHA256SUMS.txt` (`9c29b3d3`) and `.sig` (`0fdb8557`) on the signer were byte-exact. `floor.json` (`975f249d`) went to the signer through the exchange. `phase_out` was added to `helpers.sh` verbatim.

+6.1, the armed policy: PASS. `--out /root/claim-trial/policy.json`, a new path. Both the dry run and the apply succeeded with `writes: []` and `floor_sha256` `3a361ab83bbd5249aea044bbbdad8217f59e67da4d111131504a05017376ab37`, the sha256 of the compact floor `{"min":1,"min_release":"v0.28.2"}`; keep it for step 7. `policy.json` is sha256 `dfac87e6d415ed9db937a30f874e13cb20a5c161ffcd4906538412c37c4784c0`, root `600`, 507 bytes, equal to `output_sha256`.

+6.1, the identity: PASS, published. `identity-phase.json` carried the sums and signature verbatim (the `jq -j` re-reads hash to `9c29b3d3` and `0fdb8557`) and `console` `{account bab, app console, channel canary/console, version 7c1beb2d}`. The dry run was first run on its own and checked field by field. It showed one create-only put (`before_etag` empty) of `control/system/router/releases/v0.28.2.json`, `version` and `release_tag` `v0.28.2`, `moves_protocol` 1, router `bootstrap/router/v0.28.2/carlos-linux-arm64` `7141e037…f492` and console `bootstrap/console/v0.28.2/carlos-linux-arm64` `08273410…2ff4`. The payload also holds `channel stable`, `spread 0s`, `source release:v0.28.2` and `released_at` zero. Main's `SignSystemIdentity` at `7c1beb2d` sets those on purpose: the channel is "read by nothing that checks an identity", and `released_at` is "audit only; never compared". Then `phase_out` ran the dry run and the apply. Published 10:27:07Z, 1076 bytes. `identity.json` is sha256 `2d22f05fafbbe65d637ff10e79483528e9b16878d6615762cd3487e8fd9feb4c`, equal to the write's sha256 and `output_sha256`, and `cmp`-identical on DOCS-T1 to an `aws s3 cp` of the published key. Both files reached DOCS-T1 through `claim-signer/<run-id>/out/` with the same sha256, and were `staged` on leo and on sophie.

+6.2, arm leo: **STOP.** Leo had `/opt/carlos/carlos` at `carlos v0.28.2` and `carlos.prev` at `carlos v0.28.1`, with no `host-actor.json`, no `carlos-edge.service.d` and no `/opt/carlos/system/guard`. `guard-arm` printed `hostfloor: authenticated floor required`, and SSM recorded `Failed`, exit 1. It wrote nothing: afterwards there was still no `host-actor.json`, no edge drop-in and no guard directory. `carlos-edge` and `carlos-instance-control` stayed active, and `CARLOS_HOST_CLAIM` stayed unset.

+Cause, read from main at `7c1beb2d` (`internal/host/guardarm.go`): after the inputs check, `guard-arm` runs `hostfloor.CheckImage` on both `/opt/carlos/carlos` and `/opt/carlos/carlos.prev`. Each one's sha256 must equal the identity's router `linux-arm64` sha256 and be at or above the floor, otherwise it fails with a bare `ErrFloor` (line 77). Leo's `carlos.prev` is v0.28.1 (`2ae174da…`), so the check refuses it. This runbook's "after the release and protected current and previous binaries are installed" did not say that `.prev` must also be the v0.28.2 bytes, and no step puts them there. Sophie's `.prev` is also v0.28.1 (5.0a 1d), so its `guard-arm` would refuse the same way. P9, `install-console` and the console restart were not run, and the dev console is untouched (still `7c1beb2d` from 5.0a).

+Closing the signing session, 10:28Z to 10:31Z, in full:

+1. The key was shredded on the signer and `/run/claim-signer` removed.

+2. `i-0ea2852ef727929bb` was terminated, with its root volume set to delete on termination; `terminated` at 10:29:48Z. All 16 exchange objects under `claim-signer/cohort1-20261018T101832Z/` were removed by exact key, and nothing remains under `claim-signer/`. Then the role was taken out of the profile, the profile deleted, the inline policy deleted, the managed policy detached, the role deleted, and `sg-08c374c8c31ef448a` deleted.

+3. CloudTrail since `2026-10-18T10:19:37Z`, read at 10:30:34Z and again at 10:31:33Z: one `GetParameter` on `/carlos/release-key`, at 10:19:39Z from `arn:aws:sts::640012953448:assumed-role/carlos-claim-signer/i-0ea2852ef727929bb`, which is the session's one key fetch. No instance tagged `purpose=claim-signer`; `NoSuchEntity` for the role and the profile; no `carlos-claim-signer` security group. Nothing unexpected.

+Left as they are ("Stop and hold"): the roster at revision 5, the three invitations, the published identity (correct, and permanent under v0.28.2), and `policy.json` and `identity.json` staged in `/root/claim-trial` on leo and sophie. Resuming needs Paul's go for a new signing session, after a reviewed way to bring each box's `carlos.prev` to v0.28.2. A rerun of `sign-policy` and `publish-identity` with new `--out` paths should give the same bytes, and `publish-identity` writes nothing the second time.

## Step 7. Readers, floor, home and leo's key

Paul's go: once for step 7. `home_region` becomes write-once as soon as claims are on.