amadan
docs: cohort-1 runbook: 5.0a done for v0.28.4 (console f3bf1214, P9 PASS)
Block 3 of the v0.28.4 go package. The prebuilt v0.28.4 console was shipped and promoted to canary/console with the signature-verified v0.28.4 CLI. Header, readlink, on-box sha256, digests and wakecheck all pass; P9 re-run after the promote passes. No rollback. Keymail flash check skipped: it would touch a real inbox.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+35
−2
docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md+35 −2
CI passed — run details
CI log
=== gate ===
cd launchctx && go vet ./... && go test ./... -count=1
ok amadan.net/carlos/platform.git/launchctx 0.012s
? amadan.net/carlos/platform.git/launchctx/controlname [no test files]
? amadan.net/carlos/platform.git/launchctx/wireid [no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok github.com/carlosframework/platform 308.460s
? github.com/carlosframework/platform/cmd/changelog [no test files]
ok github.com/carlosframework/platform/cmd/console 3.138s
ok github.com/carlosframework/platform/cmd/moveprobe 93.193s
ok github.com/carlosframework/platform/cmd/zddprobe 0.703s
ok github.com/carlosframework/platform/internal/activator 250.792s
ok github.com/carlosframework/platform/internal/agentsock 0.016s
ok github.com/carlosframework/platform/internal/alerting 0.005s
ok github.com/carlosframework/platform/internal/analytics 0.019s
ok github.com/carlosframework/platform/internal/appconfig 2.483s
ok github.com/carlosframework/platform/internal/apperr 0.072s
ok github.com/carlosframework/platform/internal/applog 0.140s
ok github.com/carlosframework/platform/internal/awsinv 0.005s
ok github.com/carlosframework/platform/internal/boxchoice 0.005s
ok github.com/carlosframework/platform/internal/boxid 0.703s
? github.com/carlosframework/platform/internal/boxid/boxidtest [no test files]
? github.com/carlosframework/platform/internal/boxid/internal/signtest [no test files]
ok github.com/carlosframework/platform/internal/boxvolumes 0.013s
ok github.com/carlosframework/platform/internal/caps 0.015s
ok github.com/carlosframework/platform/internal/certwarm 0.002s
ok github.com/carlosframework/platform/internal/cgroup 0.691s
ok github.com/carlosframework/platform/internal/changelog 0.303s
ok github.com/carlosframework/platform/internal/claimactivation 0.024s
ok github.com/carlosframework/platform/internal/clamd 0.054s
? github.com/carlosframework/platform/internal/cliflag [no test files]
ok github.com/carlosframework/platform/internal/console 406.265s
? github.com/carlosframework/platform/internal/controlname [no test files]
? github.com/carlosframework/platform/internal/controlsock [no test files]
ok github.com/carlosframework/platform/internal/dbdoor 5.920s
ok github.com/carlosframework/platform/internal/dbdoor/dbdoortest 0.009s
ok github.com/carlosframework/platform/internal/dbverify 0.004s
ok github.com/carlosframework/platform/internal/dnsrec 0.002s
ok github.com/carlosframework/platform/internal/docsite 0.004s
ok github.com/carlosframework/platform/internal/domains 2.421s
ok github.com/carlosframework/platform/internal/doorkey 0.006s
ok github.com/carlosframework/platform/internal/economics 0.005s
ok github.com/carlosframework/platform/internal/edge 44.806s
? github.com/carlosframework/platform/internal/edgeproof [no test files]
ok github.com/carlosframework/platform/internal/edgesfile 0.008s
ok github.com/carlosframework/platform/internal/fleetapi 0.132s
ok github.com/carlosframework/platform/internal/gate 1.660s
ok github.com/carlosframework/platform/internal/genselect 0.014s
ok github.com/carlosframework/platform/internal/geo 0.016s
ok github.com/carlosframework/platform/internal/geoip 0.030s
ok github.com/carlosframework/platform/internal/historyreadback 0.152s
ok github.com/carlosframework/platform/internal/host 177.031s
ok github.com/carlosframework/platform/internal/hostactors 0.507s
ok github.com/carlosframework/platform/internal/hostbox 2.693s
ok github.com/carlosframework/platform/internal/hostclaim 0.575s
ok github.com/carlosframework/platform/internal/hostevidence 0.005s
ok github.com/carlosframework/platform/internal/hostexec 4.778s
ok github.com/carlosframework/platform/internal/hostfence 0.032s
ok github.com/carlosframework/platform/internal/hostfiles 10.406s
ok github.com/carlosframework/platform/internal/hostfloor 0.014s
ok github.com/carlosframework/platform/internal/hostguard 1.032s
ok github.com/carlosframework/platform/internal/hostops 1.613s
? github.com/carlosframework/platform/internal/hostops/fencerelease [no test files]
ok github.com/carlosframework/platform/internal/hostops/internal/fencerelease 0.002s
ok github.com/carlosframework/platform/internal/hostquarantine 0.002s
ok github.com/carlosframework/platform/internal/hostrelocate 0.468s
ok github.com/carlosframework/platform/internal/hostresolve 0.157s
ok github.com/carlosframework/platform/internal/hostwrite 0.002s
ok github.com/carlosframework/platform/internal/infraview 0.002s
ok github.com/carlosframework/platform/internal/instancectl 5.214s
ok github.com/carlosframework/platform/internal/instanceexec 2.735s
ok github.com/carlosframework/platform/internal/instancefs 0.009s
ok github.com/carlosframework/platform/internal/instancekey 0.004s
ok github.com/carlosframework/platform/internal/instanceupdates 0.007s
ok github.com/carlosframework/platform/internal/layout 1.531s
ok github.com/carlosframework/platform/internal/lbhealth 0.003s
ok github.com/carlosframework/platform/internal/lease 9.795s
ok github.com/carlosframework/platform/internal/lease/leasetest 0.005s
ok github.com/carlosframework/platform/internal/ledger 0.013s
ok github.com/carlosframework/platform/internal/mail 0.179s
ok github.com/carlosframework/platform/internal/maintenance 0.083s
ok github.com/carlosframework/platform/internal/maintenanceexec 5.481s
ok github.com/carlosframework/platform/internal/maintenanceguard 0.070s
ok github.com/carlosframework/platform/internal/metrics 0.011s
ok github.com/carlosframework/platform/internal/moves 20.995s
ok github.com/carlosframework/platform/internal/moves/archive 0.833s
ok github.com/carlosframework/platform/internal/objstore 0.185s
ok github.com/carlosframework/platform/internal/ops 0.186s
ok github.com/carlosframework/platform/internal/park 0.192s
ok github.com/carlosframework/platform/internal/privatefile 0.004s
ok github.com/carlosframework/platform/internal/provision 17.913s
ok github.com/carlosframework/platform/internal/publicrelease 0.006s
? github.com/carlosframework/platform/internal/regionname [no test files]
ok github.com/carlosframework/platform/internal/registry 5.385s
ok github.com/carlosframework/platform/internal/relay 7.219s
ok github.com/carlosframework/platform/internal/release 21.577s
ok github.com/carlosframework/platform/internal/rollout 3.650s
ok github.com/carlosframework/platform/internal/rolloutwords 0.003s
ok github.com/carlosframework/platform/internal/rootaws 0.009s
ok github.com/carlosframework/platform/internal/rootparticipation 0.057s
ok github.com/carlosframework/platform/internal/rootstate 0.026s
ok github.com/carlosframework/platform/internal/runs 0.580s
ok github.com/carlosframework/platform/internal/s3compat 0.005s
ok github.com/carlosframework/platform/internal/safefile 0.004s
ok github.com/carlosframework/platform/internal/schedule 2.502s
ok github.com/carlosframework/platform/internal/seeds 0.011s
ok github.com/carlosframework/platform/internal/sim/hostlife 8.548s
ok github.com/carlosframework/platform/internal/sim/litestreamfacts 4.354s
ok github.com/carlosframework/platform/internal/status 0.038s
ok github.com/carlosframework/platform/internal/steering 0.005s
ok github.com/carlosframework/platform/internal/stopevidence 0.262s
ok github.com/carlosframework/platform/internal/svcrole 0.002s
ok github.com/carlosframework/platform/internal/telemetry 0.004s
ok github.com/carlosframework/platform/internal/termfence 0.004s
ok github.com/carlosframework/platform/internal/tunnelclient 0.004s
ok github.com/carlosframework/platform/internal/unixdial 0.002s
ok github.com/carlosframework/platform/internal/updatewords 0.004s
ok github.com/carlosframework/platform/internal/usage 0.004s
ok github.com/carlosframework/platform/internal/version 0.001s
ok github.com/carlosframework/platform/internal/vet 1.547s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
linux/arm64 carlos binary: 48824482 bytes (ceiling 52000000)
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
minio: cached, digest verified
mc: cached, digest verified
minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
buckets and scoped user ready
=== RUN TestDeliveredContractMinio
=== RUN TestDeliveredContractMinio/put
=== RUN TestDeliveredContractMinio/get_round-trips_the_body
=== RUN TestDeliveredContractMinio/list_shows_the_key
=== RUN TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN TestDeliveredContractMinio/delete_removes_it
=== RUN TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.03s)
--- PASS: TestDeliveredContractMinio/put (0.00s)
--- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
--- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
--- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.02s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
--- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok github.com/carlosframework/platform/internal/objstore 0.035s
=== RUN TestT4StorageProbeMinio
2026/10/19 08:07:24 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18DFDFCC324CB8A8, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.01s)
PASS
ok github.com/carlosframework/platform/internal/host 0.027s
minio contract: PASS
diff --git a/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md b/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md| index 8b0acbc56..948326fb4 100644 |
| --- a/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md |
| +++ b/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md |
| @@ -6,7 +6,7 @@ Draft, first written 2026-10-16, revised 2026-10-17 against main at 26065378. St |
| Final, 2026-10-19. Every value below was read or verified read-only on DOCS-T1 between 07:50Z and 07:55Z; nothing was changed on any box or bucket. Earlier packages are in this file's history: v0.28.3 at `ccaea17f`, v0.28.2 at `72b5ab3e`. |
| -**Where things stand.** The first signing session (2026-10-18) did 5.0a (digests on for `bab`, console `7c1beb2d`), 5.1 (roster revision 5: leo in pool `cohort1`, sophie in pool `console`, `dev-console` enrolled) and 6.1 (the v0.28.2 identity published). It stopped at 6.2 on leo's v0.28.1 `carlos.prev` and was torn down (CloudTrail clean). v0.28.3 brought `install-channel --policy` but needed a tag on the channel pointer, which `carlos system update` does not write before a floor (blocker 7). Paul chose option (b): `--identity FILE` (main `f3bf1214`). v0.28.4 carries it, with platform-87's console invite delivery (`91a651b3`), and is published and on dev's boxes (platform-1e, "v0.28.4 on dev"; verified below). The dev console is still on `7c1beb2d`, waiting for 5.0a. Nothing is open. |
| +**Where things stand.** The first signing session (2026-10-18) did 5.0a (digests on for `bab`, console `7c1beb2d`), 5.1 (roster revision 5: leo in pool `cohort1`, sophie in pool `console`, `dev-console` enrolled) and 6.1 (the v0.28.2 identity published). It stopped at 6.2 on leo's v0.28.1 `carlos.prev` and was torn down (CloudTrail clean). v0.28.3 brought `install-channel --policy` but needed a tag on the channel pointer, which `carlos system update` does not write before a floor (blocker 7). Paul chose option (b): `--identity FILE` (main `f3bf1214`). v0.28.4 carries it, with platform-87's console invite delivery (`91a651b3`), and is published and on dev's boxes (platform-1e, "v0.28.4 on dev"; verified below). The dev console was on `7c1beb2d` until 5.0a, which moved it to `f3bf1214` on 2026-10-19 at 07:58Z (block 3). Nothing is open. |
| **v0.28.4 values (all confirmed)** |
| - Tag: `v0.28.4` on `f3bf1214ab92a47ecb626400e7bd1b35cd7a112c` (`git ls-remote --tags` on the forge: tag object `4807dd9d…`, peeled `v0.28.4^{}` = `f3bf1214…`). |
| @@ -34,7 +34,7 @@ Final, 2026-10-19. Every value below was read or verified read-only on DOCS-T1 b |
| **The blocks, in order, each with its stop points** |
| 1. **Release v0.28.4. DONE** (verified above). Stop rule for any re-check: the signature does not verify; the tag is not on `f3bf1214`; the sums list other debs; any published sha256 differs from the local build. |
| 2. **Dev roll, boxes only. DONE** (platform-1e: 0 refusing, no panics, wakecheck 200; verified above). Stop rule for any re-check: a box not `current` at v0.28.4, `refused` or `rolled-back`; instance-control not restarted (H4). |
| -3. **5.0a, promote-only** (approved): ship and promote `f3bf1214` to `canary/console` with the v0.28.4 amd64 CLI, then re-run P9. Stop: the console's sha256 is not `8d49199f…5e9b`; a pointer row `written after digests were turned on`; the header or `readlink` not `f3bf1214`; any P9 `SET` line or console-mail role policy. Rollback: promote `7c1beb2d`. |
| +3. **5.0a, promote-only** (approved). **DONE 2026-10-19 07:58Z, PASS**: `x-carlos-version: f3bf1214`, digests `yes`, P9 PASS, no rollback (record under 5.0a). Ship and promote `f3bf1214` to `canary/console` with the v0.28.4 amd64 CLI, then re-run P9. Stop: the console's sha256 is not `8d49199f…5e9b`; a pointer row `written after digests were turned on`; the header or `readlink` not `f3bf1214`; any P9 `SET` line or console-mail role policy. Rollback: promote `7c1beb2d`. |
| 4. **Open the session** (`signing-host.md`, "Create"). platform-1e confirms with Paul first. This puts the release key on a host a second time. Stop: a checksum mismatch; `carlos version` not `carlos v0.28.4`; `claims help` not as quoted; a key file that is not root `600`. |
| 5. **5.1, resumed** ("5.1 in the second session"): the box re-check, then `refresh` only, never `initialize`. Stop: revision not 5, the listing not as recorded, or a staged file missing or changed. |
| 6. **Step 6**: 6.1 `sign-policy` and `publish-identity` (new `--out` paths) and staging under new paths; 6.1a the `-h` check, then `install-channel --policy --identity` on leo, then sophie; 6.2 `guard-arm` on leo; 6.3 P9 (third run), `install-console`, `guard-arm --console`, `console-config`, the restart, and the wait for both boxes' `floor_guard_ready`. Stop: any refusal (6.1a lists its refusals, the `--identity` ones included); an identity value other than the expected ones above; any 6.1a output other than its expected lines; a P9 `SET` line or console-mail role policy; `console.service` not `active`. |
| @@ -280,6 +280,8 @@ The dev root grep, at `platform-infrastructure` main `a0b3f5a`, printed nothing. |
| 2026-10-19 07:54Z, after the v0.28.4 roll and before 5.0a, run read-only once from DOCS-T1: PASS. `Success`, `checked: the running console (pid 581646), console.service Environment=, and 5 files:` the same five files, no `SET` and no `missing:` line, `console mail: OFF (none of the 7 names is set)`. Sophie's role policies: `carlos-dev-host-buckets`, `carlos-dev-host-metrics`, `deny-release-key-reads`. The dev root grep at `platform-infrastructure` main `a0b3f5a` printed nothing. This run checked the `7c1beb2d` console, which predates invite delivery. |
| +2026-10-19 07:58:57Z, straight after 5.0a's promote of the `f3bf1214` console (invite delivery included), run read-only once from DOCS-T1: PASS. `Success`, `checked: the running console (pid 613198), console.service Environment=, and 5 files:` the same five files, no `SET` and no `missing:` line, `console mail: OFF (none of the 7 names is set)`. Sophie's role policies: `carlos-dev-host-buckets`, `carlos-dev-host-metrics`, `deny-release-key-reads`. After a `git fetch`, the dev root grep at `platform-infrastructure` main `a0b3f5a` printed nothing. The 6.3 run is still owed. |
| + |
| **In the v0.28.4 session P9 runs twice more:** straight after 5.0a's promote, because the invite-delivery console (`91a651b3`) reaches sophie only with that promote; and in 6.3, before `install-console`. Neither may be skipped. |
| Re-run P9 right before step 6 (step 6.3), inside the signing session and before `install-console`, because 5.0a restarts the console on a new build and the invite delivery branch may have landed by then. |
| @@ -618,6 +620,37 @@ A rollback means the second signing session cannot start: `publish-identity` for |
| Finish this step before the session opens. Its `GetParameter` reads come from `remote-agent`, and the CloudTrail check at the session's close counts from the session's start. |
| +**2026-10-19, done: PASS (block 3).** Run by an agent on the controller's instruction, under Paul's go for the console promote (relayed by platform-1e, who confirmed it was time to run it). Dev only. There was no host.env edit, no flag and no claim change, and the signing session was not opened. No rollback was needed. |
| + |
| +- **CLI.** `carlos-linux-amd64` from the v0.28.4 release, with `SHA256SUMS.txt` (`b2dcd93c…cd2f`) and `SHA256SUMS.txt.sig` (`480ecfb1…d812`). `openssl pkeyutl -verify` with the README's pinned key printed `Signature Verified Successfully`, and `sha256sum -c --ignore-missing` printed `carlos-linux-amd64: OK`. The CLI's sha256 is `2d53162f…8548`, and `version` prints `carlos v0.28.4`. |
| +- **1, 07:57Z to 07:58Z, all PASS.** Account `640012953448`. |
| + - 1a: the one key `apps/bab/console/channels/canary/console.json`, and `canary/console 7c1beb2d 2026-10-18T10:11:48Z yes`. |
| + - 1c: `x-carlos-version: 7c1beb2d`, running `/opt/carlos/versions/7c1beb2d/console`, active. The rollback version is `7c1beb2d`. |
| + - 1d: leo, sophie and dennis are `carlos v0.28.4` (`.prev` `carlos v0.28.3`). The operator CLI is `carlos v0.28.4`, and `which -a carlos` lists only `~/.local/bin/carlos`, which is `carlos v0.28.0`. |
| + - 1e: `pointer digests: on for bab since 2026-10-18T10:11:25Z`, nine rows all `no`, no `console canary/console` row and no `written after digests were turned on` row. The marker is the same 219-byte object written at 2026-10-18 10:11:26. |
| + - `apps/bab/console/releases/f3bf1214/` was absent at 07:57:34Z (`aws s3 ls` exit 1). |
| +- **2: PASS.** The output matched the expected block line for line: `8d49199f433662ab183a98ce7a5ebeb18f36bc02af5689752580a596bc565e9b`, a stripped aarch64 file of 47186082 bytes, `cmd/console`, `Build=v0.28.4` once, and `0` in `SHA256SUMS.txt`. |
| +- **4, 07:58:09Z to 07:58:22Z.** `CARLOS_BIN=<v0.28.4 CLI> .../platform-infrastructure/scripts/ship-app.sh kass carlos-dev-640012953448 console f3bf1214 canary/console binary ~/.cache/release-v0.28.4/console-linux-arm64`. The key was read inside the script and never printed. Output: |
| + |
| + ``` |
| + shipped console f3bf1214 (1 artifacts) |
| + promoted console f3bf1214 -> canary/console |
| + ``` |
| + |
| + The manifest reads `built_by carlos v0.28.4`, program `cmd/console`, `linux-arm64` sha256 `8d49199f433662ab183a98ce7a5ebeb18f36bc02af5689752580a596bc565e9b`, size 47186082. `console.service` was active again from 07:58:26Z. No root pass was needed this time. |
| + |
| +Verification, 07:58:34Z to 07:58:43Z, all PASS: |
| +- `x-carlos-version: f3bf1214`, HTTP 200. |
| +- Sophie runs `/opt/carlos/versions/f3bf1214/console`, and `console.service` is active. The file's sha256 on the box is `8d49199f433662ab183a98ce7a5ebeb18f36bc02af5689752580a596bc565e9b`. |
| +- `"$CARLOS" channels --app console --account-id bab` shows `canary/console f3bf1214 2026-10-19T07:58:22Z yes`. |
| +- `channels digests --account-id bab` shows `pointer digests: on for bab since 2026-10-18T10:11:25Z` and the same nine rows, all `no`. There is no `console canary/console` row and no `written after digests were turned on` row (count 0). |
| +- The console's `/` and `/healthz` both return 200. |
| +- wakecheck through DNS returns `wakecheck build=wc4 host=ip-172-31-14-16 ... hits=1399`, HTTP 200, 0.18 s to first byte (sophie). |
| +- P9 re-run at 07:58:57Z: PASS (recorded under P9). |
| +- The Keymail flash check was skipped because it would touch a real inbox. Checking that an invite to a Keymail address shows the Keymail flash means sending a real invite. |
| + |
| +The `f3bf1214` console is on `canary/console` with digests, which is what `publish-identity` for v0.28.4 needs. Opening the signing session needs its own confirmation (block 4), and its CloudTrail window starts after this step's last key read at 07:58Z. |
| + |
| ### 5.0a, first run: pointer digests and the v0.28.2 console (done 2026-10-18) |
| Kept for the record and for its commands, which the v0.28.4 run above reuses. |