carlos / platform Public

Merge origin/main into sec-sidecar-create-gate

Chain conflict: main's two overlays kept in order, this branch's line last (re-proposed in the next commit).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 17 hours ago 740d25ed9ef02b26ea3152a74737e9554114e463 parent fcd70fcparent 9ccf6b4

11 files changed, +187 −48

docs/superpowers/notes/census-proposal-console-brand-name.md +13 −0
docs/superpowers/notes/census-proposal-email-signin.md +4 −2
docs/superpowers/notes/census-proposal-sec-deps-dos-bumps.md +37 −0
docs/superpowers/notes/census-proposal-sec-host-imdsv2-module.md +28 −0
go.mod +11 −12
go.sum +22 −34
infra/modules/region-host/main.tf +13 −0
infra/modules/region-host/tests/instance_metadata.tftest.hcl +49 −0
internal/provision/testdata/plan14-root-reads-chain.tsv +2 −0
internal/provision/testdata/plan14-root-reads-sec-deps-dos-bumps.tsv +3 −0
internal/provision/testdata/plan14-root-reads-sec-host-imdsv2-module.tsv +5 −0

diff --git a/docs/superpowers/notes/census-proposal-console-brand-name.md b/docs/superpowers/notes/census-proposal-console-brand-name.md

new file mode 100644

index 000000000..e2e8ccd7d

--- /dev/null

+++ b/docs/superpowers/notes/census-proposal-console-brand-name.md

@@ -0,0 +1,13 @@

+# Census: console brand name

+Status: APPROVED by Paul (census owner), 2026-10-24, recorded on #280 with

+main at 65ca4aca. Rows keep `rev3=PROPOSED-console-brand-name` (no flip under

+#369).

+Overlay `internal/provision/testdata/plan14-root-reads-console-brand-name.tsv`,

+landed with 5f341f3. The console's chrome and new-account welcome name the

+deployment from `CARLOS_CONSOLE_NAME`. Three embedded templates change text

+only (`apps.html`, `home.html`, `layout.html`), and the `internal/console` and

+`internal/console/templates` envelopes are re-pinned. No read, file or record

+write is added. The units run in the console (`cmd/console serve` under

+`console.service`, user carlos-console).

diff --git a/docs/superpowers/notes/census-proposal-email-signin.md b/docs/superpowers/notes/census-proposal-email-signin.md

index f1f186c70..c32d7eb3a 100644

--- a/docs/superpowers/notes/census-proposal-email-signin.md

+++ b/docs/superpowers/notes/census-proposal-email-signin.md

@@ -1,7 +1,9 @@

# Census: console email sign-in

-Status: PROPOSED. Every row carries `rev3=PROPOSED-email-signin`. The ruling

-is asked of the census owner on #280.

+Status: APPROVED by Paul (census owner), 2026-10-24, recorded on #280 with

+main at 65ca4aca. The rows keep `rev3=PROPOSED-email-signin`: under the #369

+process nothing is flipped, and later overlays re-froze units at these

+dispositions, so a flip would move their fingerprints.

Branch `email-signin`, cut from main at 4d6f0e6c. Design:

`docs/superpowers/specs/2026-10-21-console-email-signin-design.md`.

diff --git a/docs/superpowers/notes/census-proposal-sec-deps-dos-bumps.md b/docs/superpowers/notes/census-proposal-sec-deps-dos-bumps.md

new file mode 100644

index 000000000..97d2e1f04

--- /dev/null

+++ b/docs/superpowers/notes/census-proposal-sec-deps-dos-bumps.md

@@ -0,0 +1,37 @@

+# Census approval: sec-deps-dos-bumps

+Ruling `census-ruling-sec-deps-dos-bumps`. Every change below keeps the disposition it already has, so it needs an approval, not a decision.

+Envelopes re-pinned: `.`.

+Seal: `945934f5978ace14dc5a9bae0ed69dfabf29b994504fc843c03d4a633ecd6c6a` → `945934f5978ace14dc5a9bae0ed69dfabf29b994504fc843c03d4a633ecd6c6a` (unchanged; loaded after sec-host-imdsv2-module, re-chained 2026-10-24 when that merged as ef156d3).

+Overlay: `internal/provision/testdata/plan14-root-reads-sec-deps-dos-bumps.tsv`, appended to `internal/provision/testdata/plan14-root-reads-chain.tsv`.

+## Branch context

+Branch `sec-deps-dos-bumps` bumps three modules that govulncheck reports as

+reachable on main:

+|---|---|---|---|

+| `golang.org/x/net` | v0.56.0 | v0.60.0 | GO-2026-6603, -6610, -6611, -6612, -6617 (HTTP/2 server and transport DoS) |

+| `golang.org/x/text` | v0.38.0 | v0.42.0 | GO-2026-5970 (idna infinite loop, reached from the edge's TLS SNI handling) |

+| `github.com/pion/stun/v3` | v3.0.1 | v3.1.5 | GO-2026-6163 (panic on a malformed XOR-MAPPED-ADDRESS, reached from the relay's TURN server) |

+x/text lands at v0.42.0, not v0.39.0, because x/net v0.60.0 requires it. The

+same requirement moves x/crypto (v0.57.0), x/sys (v0.48.0), x/sync (v0.23.0),

+x/mod (v0.41.0) and x/tools (v0.49.0), and raises go.mod's `go` directive from

+`1.26` to `1.26.0`. stun v3.1.5 moves pion/dtls/v3 to v3.1.4 and

+pion/transport/v4 to v4.0.2, and drops pion/transport/v3. pion/turn/v4 stays at

+v4.1.4.

+The change is go.mod and go.sum only. No Go source file changes, so no read is

+added, removed or changed, no census unit's digest moves, and the legacy seal

+does not move. The only census effect is the envelope re-pin of `.` above.

+The record-write census (9B8) and claim routes are unchanged.

+go.mod meets `go-1.26.10-emudhra`, which raises the same `go` directive to

+`1.26.10` and pins `.` in its own overlay. Whichever lands second takes

+`1.26.10` and re-pins `.` once more (rerun `make census-propose` with the same

+NAME).

diff --git a/docs/superpowers/notes/census-proposal-sec-host-imdsv2-module.md b/docs/superpowers/notes/census-proposal-sec-host-imdsv2-module.md

new file mode 100644

index 000000000..37512514f

--- /dev/null

+++ b/docs/superpowers/notes/census-proposal-sec-host-imdsv2-module.md

@@ -0,0 +1,28 @@

+# Census approval: sec-host-imdsv2-module

+Ruling `census-ruling-sec-host-imdsv2-module`. Every change below keeps the disposition it already has, so it needs an approval, not a decision.

+|---|---|---|---|

+| `infra/modules/region-host/main.tf` `external` | body | unchanged (1) | aws_instance.host gains metadata_options (IMDSv2 required, hop limit 1, endpoint enabled), matching scanner-host; tofu configuration only, run on an operator's machine; no read, file or record write is added; applies in place on a running instance with no restart |

+Envelopes re-pinned: `infra/modules/region-host`.

+Seal: `09e20ea4bbc534710334e632e903878656dabfb5817d4d96c6e7c56508172148` → `945934f5978ace14dc5a9bae0ed69dfabf29b994504fc843c03d4a633ecd6c6a`.

+Overlay: `internal/provision/testdata/plan14-root-reads-sec-host-imdsv2-module.tsv`, appended to `internal/provision/testdata/plan14-root-reads-chain.tsv`.

+## Branch context

+The branch `sec-host-imdsv2-module` adds a `metadata_options` block to

+`aws_instance.host` in `infra/modules/region-host/main.tf` (IMDSv2 required,

+hop limit 1, endpoint enabled), matching scanner-host, and a plan-time tofu

+test under `infra/modules/region-host/tests/`. The record-write census does

+not change: no record write is added or moved.

+The new `tests/instance_metadata.tftest.hcl` is outside the census: the scan's

+extension list excludes `.tftest.hcl`, and envelopes group by immediate

+directory, so the module hash covers only the `.tf` files.

+Executing identity: tofu on an operator's machine with the operator's AWS

+credentials; no box unit runs the file and no binary embeds it.

diff --git a/go.mod b/go.mod

index 5a0e3cad5..c320d08df 100644

--- a/go.mod

+++ b/go.mod

@@ -1,6 +1,6 @@

module github.com/carlosframework/platform

-go 1.26

+go 1.26.0

require (

github.com/aws/aws-sdk-go-v2 v1.44.0

@@ -21,12 +21,12 @@ require (

github.com/aws/smithy-go v1.28.1

github.com/benbjohnson/litestream v0.5.14

github.com/pion/logging v0.2.4

- github.com/pion/stun/v3 v3.0.1

+ github.com/pion/stun/v3 v3.1.5

github.com/pion/turn/v4 v4.1.4

github.com/superfly/ltx v0.5.1

- golang.org/x/crypto v0.53.0

- golang.org/x/net v0.56.0

- golang.org/x/sys v0.46.0

+ golang.org/x/crypto v0.57.0

+ golang.org/x/net v0.60.0

+ golang.org/x/sys v0.48.0

modernc.org/sqlite v1.55.0

)

@@ -60,10 +60,9 @@ require (

github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect

github.com/ncruces/go-strftime v1.0.0 // indirect

github.com/pierrec/lz4/v4 v4.1.22 // indirect

- github.com/pion/dtls/v3 v3.0.7 // indirect

+ github.com/pion/dtls/v3 v3.1.4 // indirect

github.com/pion/randutil v0.1.0 // indirect

- github.com/pion/transport/v3 v3.0.8 // indirect

- github.com/pion/transport/v4 v4.0.1 // indirect

+ github.com/pion/transport/v4 v4.0.2 // indirect

github.com/prometheus/client_golang v1.17.0 // indirect

github.com/prometheus/client_model v0.5.0 // indirect

github.com/prometheus/common v0.45.0 // indirect

@@ -73,8 +72,9 @@ require (

github.com/tetratelabs/wazero v1.2.1 // indirect

github.com/wasilibs/go-re2 v1.3.0 // indirect

github.com/wlynxg/anet v0.0.5 // indirect

- golang.org/x/sync v0.21.0 // indirect

- golang.org/x/text v0.38.0 // indirect

+ golang.org/x/mod v0.41.0 // indirect

+ golang.org/x/sync v0.23.0 // indirect

+ golang.org/x/text v0.42.0 // indirect

google.golang.org/protobuf v1.36.10 // indirect

modernc.org/libc v1.74.1 // indirect

modernc.org/mathutil v1.7.1 // indirect

@@ -86,8 +86,7 @@ require (

github.com/aws/aws-sdk-go-v2/service/sns v1.43.0

github.com/klauspost/compress v1.18.0

github.com/oschwald/maxminddb-golang v1.13.1

- golang.org/x/mod v0.37.0

- golang.org/x/tools v0.47.0

+ golang.org/x/tools v0.49.0

)

replace amadan.net/carlos/platform.git/launchctx => ./launchctx

diff --git a/go.sum b/go.sum

index 4558d7955..a7dd6e987 100644

--- a/go.sum

+++ b/go.sum

@@ -154,18 +154,16 @@ github.com/oschwald/maxminddb-golang v1.13.1 h1:G3wwjdN9JmIK2o/ermkHM+98oX5fS+k5

github.com/oschwald/maxminddb-golang v1.13.1/go.mod h1:K4pgV9N/GcK694KSTmVSDTODk4IsCNThNdTmnaBZ/F8=

github.com/pierrec/lz4/v4 v4.1.22 h1:cKFw6uJDK+/gfw5BcDL0JL5aBsAFdsIT18eRtLj7VIU=

github.com/pierrec/lz4/v4 v4.1.22/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=

-github.com/pion/dtls/v3 v3.0.7 h1:bItXtTYYhZwkPFk4t1n3Kkf5TDrfj6+4wG+CZR8uI9Q=

-github.com/pion/dtls/v3 v3.0.7/go.mod h1:uDlH5VPrgOQIw59irKYkMudSFprY9IEFCqz/eTz16f8=

+github.com/pion/dtls/v3 v3.1.4 h1:QhvtMflMfu9Kf0RcDC5BJBle4caPskByrKQR6uuYqpY=

+github.com/pion/dtls/v3 v3.1.4/go.mod h1:cr/qotLISUw/9C1m83ZPNZtj9WnXkYLpfCptPqbkInc=

github.com/pion/logging v0.2.4 h1:tTew+7cmQ+Mc1pTBLKH2puKsOvhm32dROumOZ655zB8=

github.com/pion/logging v0.2.4/go.mod h1:DffhXTKYdNZU+KtJ5pyQDjvOAh/GsNSyv1lbkFbe3so=

github.com/pion/randutil v0.1.0 h1:CFG1UdESneORglEsnimhUjf33Rwjubwj6xfiOXBa3mA=

github.com/pion/randutil v0.1.0/go.mod h1:XcJrSMMbbMRhASFVOlj/5hQial/Y8oH/HVo7TBZq+j8=

-github.com/pion/stun/v3 v3.0.1 h1:jx1uUq6BdPihF0yF33Jj2mh+C9p0atY94IkdnW174kA=

-github.com/pion/stun/v3 v3.0.1/go.mod h1:RHnvlKFg+qHgoKIqtQWMOJF52wsImCAf/Jh5GjX+4Tw=

-github.com/pion/transport/v3 v3.0.8 h1:oI3myyYnTKUSTthu/NZZ8eu2I5sHbxbUNNFW62olaYc=

-github.com/pion/transport/v3 v3.0.8/go.mod h1:+c2eewC5WJQHiAA46fkMMzoYZSuGzA/7E2FPrOYHctQ=

-github.com/pion/transport/v4 v4.0.1 h1:sdROELU6BZ63Ab7FrOLn13M6YdJLY20wldXW2Cu2k8o=

-github.com/pion/transport/v4 v4.0.1/go.mod h1:nEuEA4AD5lPdcIegQDpVLgNoDGreqM/YqmEx3ovP4jM=

+github.com/pion/stun/v3 v3.1.5 h1:Y1FHlhaI6+4UoC5i/zQf4F7JvdZtB24/05oyy/GF1x8=

+github.com/pion/stun/v3 v3.1.5/go.mod h1:zRUghXSQU32Lx5orJsz3uYMkIihweXb3mu5gIns02fs=

+github.com/pion/transport/v4 v4.0.2 h1:ifYlPqNwsy6aKQ9y8yzxXlHae5431ZrH2avkD/Rn6Tk=

+github.com/pion/transport/v4 v4.0.2/go.mod h1:06hFI+jCFcok2X2MekVufNZ/uzNZXivGBPfviSVcjgM=

github.com/pion/turn/v4 v4.1.4 h1:EU11yMXKIsK43FhcUnjLlrhE4nboHZq+TXBIi3QpcxQ=

github.com/pion/turn/v4 v4.1.4/go.mod h1:ES1DXVFKnOhuDkqn9hn5VJlSWmZPaRJLyBXoOeO/BmQ=

github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=

@@ -214,35 +212,25 @@ go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF

go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs=

go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=

go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=

-golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=

-golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=

-golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=

-golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=

-golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=

-golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=

-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=

-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=

-golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=

-golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=

-golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=

-golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=

+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=

+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=

+golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=

+golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=

+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=

+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=

golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=

golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=

-golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=

-golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=

+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=

+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=

golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

-golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=

-golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=

-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=

-golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=

-golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=

-golang.org/x/time v0.10.0 h1:3usCWA8tQn0L8+hFJQNgzpWbd89begxN66o1Ojdn5L4=

-golang.org/x/time v0.10.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=

-golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=

-golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=

-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=

-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=

+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=

+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=

+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=

+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=

+golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=

+golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=

+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=

+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=

golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

google.golang.org/api v0.155.0 h1:vBmGhCYs0djJttDNynWo44zosHlPvHmA0XiN2zP2DtA=

google.golang.org/api v0.155.0/go.mod h1:GI5qK5f40kCpHfPn6+YzGAByIKWv8ujFnmoWm7Igduk=

diff --git a/infra/modules/region-host/main.tf b/infra/modules/region-host/main.tf

index b35ecc196..11fca1987 100644

--- a/infra/modules/region-host/main.tf

+++ b/infra/modules/region-host/main.tf

@@ -490,6 +490,19 @@ resource "aws_instance" "host" {

iam_instance_profile = aws_iam_instance_profile.host.name

user_data = var.user_data

user_data_replace_on_change = false

+ # IMDSv2 only, one hop. With the block absent EC2 leaves IMDSv1 on, and a

+ # plain GET from any request-forgery bug in a tenant app reads this

+ # role's credentials; v2 needs a PUT with a header first, which those

+ # bugs rarely give an attacker. Hop limit 1 keeps the token from leaving

+ # the box. Changing these on a running instance is in place, no restart.

+ # The flagship boxes were switched by hand on 2026-10-23; this keeps a

+ # replaced box from coming back on v1. The scanner host has done the same

+ # since it was written.

+ metadata_options {

+ http_endpoint = "enabled"

+ http_tokens = "required"

+ http_put_response_hop_limit = 1

+ }

root_block_device {

volume_size = var.root_volume_size

volume_type = "gp3"

diff --git a/infra/modules/region-host/tests/instance_metadata.tftest.hcl b/infra/modules/region-host/tests/instance_metadata.tftest.hcl

new file mode 100644

index 000000000..a2c60aa2e

--- /dev/null

+++ b/infra/modules/region-host/tests/instance_metadata.tftest.hcl

@@ -0,0 +1,49 @@

+# Plan-time tests for the host instance's metadata service settings.

+# mock_provider means no AWS account and no credentials.

+mock_provider "aws" {}

+override_data {

+ target = data.aws_vpcs.default

+ values = { ids = ["vpc-0aaaaaaaaaaaaaaaa"] }

+override_data {

+ target = data.aws_caller_identity.current

+ values = { account_id = "123456789012" }

+# The termination queue's ARN feeds an EventBridge target, which the provider

+# validates as an ARN; the mock's random string is not one.

+override_resource {

+ target = aws_sqs_queue.terminations

+ values = { arn = "arn:aws:sqs:eu-west-1:123456789012:carlos-test-host-terminations" }

+variables {

+ name = "carlos-test-ie"

+ sg_description = "carlos test host"

+ iam_name = "carlos-test-host"

+ instance_type = "t4g.small"

+ root_volume_size = 20

+ user_data = "#!/bin/sh\n"

+ deployment_bucket_arn = "arn:aws:s3:::carlos-test-platform"

+ data_bucket_arn = "arn:aws:s3:::carlos-test-ie"

+ ssm_parameter_arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/carlos/*"

+run "imdsv2_only" {

+ command = plan

+ assert {

+ condition = aws_instance.host.metadata_options[0].http_tokens == "required"

+ error_message = "the host requires IMDSv2 tokens"

+ }

+ assert {

+ condition = aws_instance.host.metadata_options[0].http_put_response_hop_limit == 1

+ error_message = "the IMDS token must not leave the box (hop limit 1)"

+ }

+ assert {

+ condition = aws_instance.host.metadata_options[0].http_endpoint == "enabled"

+ error_message = "the endpoint stays on: the box role is how the host reaches AWS"

+ }

diff --git a/internal/provision/testdata/plan14-root-reads-chain.tsv b/internal/provision/testdata/plan14-root-reads-chain.tsv

index 8af052c4e..0f4e5b1f9 100644

--- a/internal/provision/testdata/plan14-root-reads-chain.tsv

+++ b/internal/provision/testdata/plan14-root-reads-chain.tsv

@@ -1,4 +1,6 @@

# Census chain manifest: overlays loaded after rootReadChain's own, in order.

# One per line: <overlay file name under testdata>\t<the seal it leaves>.

# make census-propose appends here; nothing else edits this file.

+plan14-root-reads-sec-host-imdsv2-module.tsv 945934f5978ace14dc5a9bae0ed69dfabf29b994504fc843c03d4a633ecd6c6a

+plan14-root-reads-sec-deps-dos-bumps.tsv 945934f5978ace14dc5a9bae0ed69dfabf29b994504fc843c03d4a633ecd6c6a

plan14-root-reads-sec-sidecar-create-gate.tsv b4112b3c065b9bb4be0e3e03fb661fdfb7f44e2f712007ccda1abb69ebdaa8ca

diff --git a/internal/provision/testdata/plan14-root-reads-sec-deps-dos-bumps.tsv b/internal/provision/testdata/plan14-root-reads-sec-deps-dos-bumps.tsv

new file mode 100644

index 000000000..02c33bd1e

--- /dev/null

+++ b/internal/provision/testdata/plan14-root-reads-sec-deps-dos-bumps.tsv

@@ -0,0 +1,3 @@

+# Census overlay sec-deps-dos-bumps, written by census-propose (#369). census-ruling-sec-deps-dos-bumps, approved by the census owner before the merge; the approval card is docs/superpowers/notes/census-proposal-sec-deps-dos-bumps.md.

+# 0 body, 0 sites, 1 envelope: each changed unit re-frozen at its existing disposition with its claim appended.

+@coverage . ff7e60e8734238290264ba3b27931d9477811d9a37921a205b1b7244a610bef0

diff --git a/internal/provision/testdata/plan14-root-reads-sec-host-imdsv2-module.tsv b/internal/provision/testdata/plan14-root-reads-sec-host-imdsv2-module.tsv

new file mode 100644

index 000000000..c4ac824f6

--- /dev/null

+++ b/internal/provision/testdata/plan14-root-reads-sec-host-imdsv2-module.tsv

@@ -0,0 +1,5 @@

+# Census overlay sec-host-imdsv2-module, written by census-propose (#369). census-ruling-sec-host-imdsv2-module, approved by the census owner before the merge; the approval card is docs/superpowers/notes/census-proposal-sec-host-imdsv2-module.md.

+# 1 body, 0 sites, 1 envelope: each changed unit re-frozen at its existing disposition with its claim appended.

+@legacy bf41de79166910448a12a9ba5e5568bc7365193b909d5ebbe942facce8ecb95c infra/modules/region-host/main.tf external legacy accepted-legacy accepted-legacy;rev3=census-ruling-console-invite-delivery;basis=tofu on an operator's machine with the operator's AWS credentials (no box unit; no binary embeds the file): main's module with one optional aws_iam_role_policy, host_console_mail, count 0 unless console_mail_from is set; it grants the host role ses:SendEmail on the one sending identity, the carlos-bab configuration set and its tenants, conditioned on ses:FromAddress equal to console_mail_from; no read is added and nothing on a box reads the file;rev3=census-ruling-sec-host-imdsv2-module;basis=aws_instance.host gains metadata_options (IMDSv2 required, hop limit 1, endpoint enabled), matching scanner-host; tofu configuration only, run on an operator's machine; no read, file or record write is added; applies in place on a running instance with no restart file:external@0 8ec89e75ca0a0d2ddde74bffe226adb5a5935249fd41590bcce1623c5201ab47

+infra/modules/region-host/main.tf external legacy accepted-legacy accepted-legacy;rev3=census-ruling-console-invite-delivery;basis=tofu on an operator's machine with the operator's AWS credentials (no box unit; no binary embeds the file): main's module with one optional aws_iam_role_policy, host_console_mail, count 0 unless console_mail_from is set; it grants the host role ses:SendEmail on the one sending identity, the carlos-bab configuration set and its tenants, conditioned on ses:FromAddress equal to console_mail_from; no read is added and nothing on a box reads the file;rev3=census-ruling-sec-host-imdsv2-module;basis=aws_instance.host gains metadata_options (IMDSv2 required, hop limit 1, endpoint enabled), matching scanner-host; tofu configuration only, run on an operator's machine; no read, file or record write is added; applies in place on a running instance with no restart file:external@0 8ec89e75ca0a0d2ddde74bffe226adb5a5935249fd41590bcce1623c5201ab47

+@coverage infra/modules/region-host 5f1b1bbc02603a54e136ff004e2495bef2b0f22054e058b5930a539749b1b558