amadan
runbook: paused state, the dev console's claim runtime off (2026-10-19)
7.4's console-config --enable-console-runtime reversed on sophie: claim-console.env back to 6.3's off form (CARLOS_HOST_CLAIM= blank), the 7.4 file and drop-in saved under /root/claim-trial/paused-20261019, guard drop-in and protected console unchanged. Records the checks and the exact resume.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+63
−0
docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md+63 −0
CI passed — run details
CI log
=== gate ===
cd launchctx && go vet ./... && go test ./... -count=1
ok amadan.net/carlos/platform.git/launchctx 0.011s
? amadan.net/carlos/platform.git/launchctx/controlname [no test files]
? amadan.net/carlos/platform.git/launchctx/wireid [no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok github.com/carlosframework/platform 296.635s
? github.com/carlosframework/platform/cmd/changelog [no test files]
ok github.com/carlosframework/platform/cmd/console 2.983s
ok github.com/carlosframework/platform/cmd/moveprobe 92.152s
ok github.com/carlosframework/platform/cmd/zddprobe 0.699s
ok github.com/carlosframework/platform/internal/activator 250.868s
ok github.com/carlosframework/platform/internal/agentsock 0.014s
ok github.com/carlosframework/platform/internal/alerting 0.003s
ok github.com/carlosframework/platform/internal/analytics 0.018s
ok github.com/carlosframework/platform/internal/appconfig 2.441s
ok github.com/carlosframework/platform/internal/apperr 0.075s
ok github.com/carlosframework/platform/internal/applog 0.131s
ok github.com/carlosframework/platform/internal/awsinv 0.003s
ok github.com/carlosframework/platform/internal/boxchoice 0.004s
ok github.com/carlosframework/platform/internal/boxid 0.801s
? github.com/carlosframework/platform/internal/boxid/boxidtest [no test files]
? github.com/carlosframework/platform/internal/boxid/internal/signtest [no test files]
ok github.com/carlosframework/platform/internal/boxvolumes 0.008s
ok github.com/carlosframework/platform/internal/caps 0.013s
ok github.com/carlosframework/platform/internal/certwarm 0.002s
ok github.com/carlosframework/platform/internal/cgroup 0.691s
ok github.com/carlosframework/platform/internal/changelog 0.302s
ok github.com/carlosframework/platform/internal/claimactivation 0.026s
ok github.com/carlosframework/platform/internal/clamd 0.054s
? github.com/carlosframework/platform/internal/cliflag [no test files]
ok github.com/carlosframework/platform/internal/console 402.183s
? github.com/carlosframework/platform/internal/controlname [no test files]
? github.com/carlosframework/platform/internal/controlsock [no test files]
ok github.com/carlosframework/platform/internal/dbdoor 5.662s
ok github.com/carlosframework/platform/internal/dbdoor/dbdoortest 0.008s
ok github.com/carlosframework/platform/internal/dbverify 0.004s
ok github.com/carlosframework/platform/internal/dnsrec 0.002s
ok github.com/carlosframework/platform/internal/docsite 0.004s
ok github.com/carlosframework/platform/internal/domains 2.418s
ok github.com/carlosframework/platform/internal/doorkey 0.006s
ok github.com/carlosframework/platform/internal/economics 0.005s
ok github.com/carlosframework/platform/internal/edge 44.905s
? github.com/carlosframework/platform/internal/edgeproof [no test files]
ok github.com/carlosframework/platform/internal/edgesfile 0.007s
ok github.com/carlosframework/platform/internal/fleetapi 0.130s
ok github.com/carlosframework/platform/internal/gate 1.655s
ok github.com/carlosframework/platform/internal/genselect 0.014s
ok github.com/carlosframework/platform/internal/geo 0.018s
ok github.com/carlosframework/platform/internal/geoip 0.029s
ok github.com/carlosframework/platform/internal/historyreadback 0.154s
ok github.com/carlosframework/platform/internal/host 175.273s
ok github.com/carlosframework/platform/internal/hostactors 0.510s
ok github.com/carlosframework/platform/internal/hostbox 2.728s
ok github.com/carlosframework/platform/internal/hostclaim 0.590s
ok github.com/carlosframework/platform/internal/hostevidence 0.011s
ok github.com/carlosframework/platform/internal/hostexec 4.679s
ok github.com/carlosframework/platform/internal/hostfence 0.042s
ok github.com/carlosframework/platform/internal/hostfiles 10.419s
ok github.com/carlosframework/platform/internal/hostfloor 0.012s
ok github.com/carlosframework/platform/internal/hostguard 1.039s
ok github.com/carlosframework/platform/internal/hostops 1.604s
? github.com/carlosframework/platform/internal/hostops/fencerelease [no test files]
ok github.com/carlosframework/platform/internal/hostops/internal/fencerelease 0.012s
ok github.com/carlosframework/platform/internal/hostquarantine 0.011s
ok github.com/carlosframework/platform/internal/hostrelocate 0.449s
ok github.com/carlosframework/platform/internal/hostresolve 0.141s
ok github.com/carlosframework/platform/internal/hostwrite 0.012s
ok github.com/carlosframework/platform/internal/infraview 0.012s
ok github.com/carlosframework/platform/internal/instancectl 5.208s
ok github.com/carlosframework/platform/internal/instanceexec 2.733s
ok github.com/carlosframework/platform/internal/instancefs 0.017s
ok github.com/carlosframework/platform/internal/instancekey 0.012s
ok github.com/carlosframework/platform/internal/instanceupdates 0.007s
ok github.com/carlosframework/platform/internal/layout 1.537s
ok github.com/carlosframework/platform/internal/lbhealth 0.002s
ok github.com/carlosframework/platform/internal/lease 9.786s
ok github.com/carlosframework/platform/internal/lease/leasetest 0.006s
ok github.com/carlosframework/platform/internal/ledger 0.011s
ok github.com/carlosframework/platform/internal/mail 0.177s
ok github.com/carlosframework/platform/internal/maintenance 0.073s
ok github.com/carlosframework/platform/internal/maintenanceexec 5.500s
ok github.com/carlosframework/platform/internal/maintenanceguard 0.068s
ok github.com/carlosframework/platform/internal/metrics 0.005s
ok github.com/carlosframework/platform/internal/moves 20.966s
ok github.com/carlosframework/platform/internal/moves/archive 0.827s
ok github.com/carlosframework/platform/internal/objstore 0.184s
ok github.com/carlosframework/platform/internal/ops 0.172s
ok github.com/carlosframework/platform/internal/park 0.192s
ok github.com/carlosframework/platform/internal/privatefile 0.004s
ok github.com/carlosframework/platform/internal/provision 17.431s
ok github.com/carlosframework/platform/internal/publicrelease 0.007s
? github.com/carlosframework/platform/internal/regionname [no test files]
ok github.com/carlosframework/platform/internal/registry 5.377s
ok github.com/carlosframework/platform/internal/relay 7.215s
ok github.com/carlosframework/platform/internal/release 21.248s
ok github.com/carlosframework/platform/internal/rollout 3.603s
ok github.com/carlosframework/platform/internal/rolloutwords 0.003s
ok github.com/carlosframework/platform/internal/rootaws 0.007s
ok github.com/carlosframework/platform/internal/rootparticipation 0.057s
ok github.com/carlosframework/platform/internal/rootstate 0.026s
ok github.com/carlosframework/platform/internal/runs 0.572s
ok github.com/carlosframework/platform/internal/s3compat 0.007s
ok github.com/carlosframework/platform/internal/safefile 0.004s
ok github.com/carlosframework/platform/internal/schedule 2.468s
ok github.com/carlosframework/platform/internal/seeds 0.010s
ok github.com/carlosframework/platform/internal/sim/hostlife 8.352s
ok github.com/carlosframework/platform/internal/sim/litestreamfacts 4.329s
ok github.com/carlosframework/platform/internal/status 0.041s
ok github.com/carlosframework/platform/internal/steering 0.005s
ok github.com/carlosframework/platform/internal/stopevidence 0.123s
ok github.com/carlosframework/platform/internal/svcrole 0.002s
ok github.com/carlosframework/platform/internal/telemetry 0.003s
ok github.com/carlosframework/platform/internal/termfence 0.004s
ok github.com/carlosframework/platform/internal/tunnelclient 0.004s
ok github.com/carlosframework/platform/internal/unixdial 0.002s
ok github.com/carlosframework/platform/internal/updatewords 0.004s
ok github.com/carlosframework/platform/internal/usage 0.006s
ok github.com/carlosframework/platform/internal/version 0.001s
ok github.com/carlosframework/platform/internal/vet 1.542s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
linux/arm64 carlos binary: 48824482 bytes (ceiling 52000000)
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
minio: cached, digest verified
mc: cached, digest verified
minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
buckets and scoped user ready
=== RUN TestDeliveredContractMinio
=== RUN TestDeliveredContractMinio/put
=== RUN TestDeliveredContractMinio/get_round-trips_the_body
=== RUN TestDeliveredContractMinio/list_shows_the_key
=== RUN TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN TestDeliveredContractMinio/delete_removes_it
=== RUN TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
--- PASS: TestDeliveredContractMinio/put (0.00s)
--- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
--- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
--- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
--- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok github.com/carlosframework/platform/internal/objstore 0.022s
=== RUN TestT4StorageProbeMinio
2026/10/19 23:06:38 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18E010DE347FDC6A, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.00s)
PASS
ok github.com/carlosframework/platform/internal/host 0.019s
minio contract: PASS
diff --git a/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md b/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md| index 9eb80319e..4be8d6d04 100644 |
| --- a/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md |
| +++ b/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md |
| @@ -9,6 +9,69 @@ |
| > |
| > Together these mean activating one cohort box inside a populated deployment isn't designed yet. platform-1e is writing the design note with Astra's review. Full report: platform-1e's `after236/step8-readiness-report.md`. Status: amadan #250. |
| +## Paused state (2026-10-19) |
| + |
| +On Paul's go, given directly to the controller and specified by platform-1e: the dev console's claim runtime is OFF while the trial is paused. This reverses 7.4's `console-config --enable-console-runtime` on sophie and nothing else. It was done from DOCS-T1 (profile `kass`) over SSM `send-command`, 22:51Z to 22:55Z. |
| + |
| +**What 7.4 wrote, read from `f3bf1214`.** `console-config` writes two files and nothing else: `/etc/carlos/claim-console.env` (root `600`) and `/etc/systemd/system/console.service.d/91-claim-runtime.conf` (root `644`, `EnvironmentFile=/etc/carlos/claim-console.env`). The env file is always `CARLOS_CONSOLE_ID=<id>`, `CONSOLE_HOME_REGION=ie` and `CARLOS_HOST_CLAIM=`. `--enable-console-runtime` only changes that last line to `CARLOS_HOST_CLAIM=1` (`activationConsoleEnvironment`). So 6.3's run wrote the off form (72 bytes) and 7.4's run changed one line of it (73 bytes). The drop-in is the same bytes both times. 6.3's guard is a separate file, `90-host-floor.conf`, holding only the `ExecStart` through `guard-exec` and the protected console. Nothing is shared. |
| + |
| +**No supported reverse.** `claims help` lists no disable option, and no commit on main after `f3bf1214` touches these files. `installActivationConsole` accepts an existing env file only if it equals the new content or that content with the flag blank. So going from on to off refuses: a `console-config` dry run without the flag, at revision 9, printed `claim activation: input or protected state refused` (22:52:57Z). |
| + |
| +**Before (22:51Z).** `console.service`: `active` since 19:35:50Z, PID 647490, `/opt/carlos/system/console/console` as `carlos`, with `CARLOS_HOST_CLAIM=1` in its environment. Its journal had `run sweep: off on a host-claim console` and `seeds pass: off on a host-claim console`. The files, all root, one link: |
| + |
| +| File | Mode | Size | sha256 | Written by | |
| +|---|---|---|---|---| |
| +| `/etc/systemd/system/console.service` | 644 | 495 | `028d6509…7bcf` | box setup (2026-09-07) | |
| +| `console.service.d/90-host-floor.conf` | 644 | 130 | `887585fe…5518` | 6.3, `guard-arm --console` | |
| +| `console.service.d/91-claim-runtime.conf` | 644 | 56 | `815226c3…e938` | 6.3 and 7.4, `console-config` | |
| +| `console.service.d/apps-domain.conf` | 644 | 60 | `ed501265…81ba` | earlier (2026-10-14) | |
| +| `console.service.d/release-key.conf` | 644 | 51 | `db00b7fc…a257` | earlier (2026-10-13) | |
| +| `/etc/carlos/host.env` | 600 | 677 | `1e66ddb0…27a7` | earlier; no `CARLOS_HOST_CLAIM` or `CARLOS_REGION` | |
| +| `/etc/carlos/claim-console.env` | 600 | 73 | `5df17bac…1d03` | 7.4, `console-config --enable-console-runtime` | |
| +| `/etc/carlos/release.env` | 600 | 64 | `7d6bdba3…e0d3` | earlier (2026-10-13) | |
| + |
| +**Saved copies.** `/root/claim-trial/paused-20261019/` on sophie, root `700`, made with `cp -p` and `cmp`-equal to the live files: |
| +- `claim-console.env`, root `600`, 73 bytes, `5df17bac42a91a02d90584edc5476c045400af57e467b2ea0815ba50b7e31d03` (7.4's file, `CARLOS_HOST_CLAIM=1`); |
| +- `91-claim-runtime.conf`, root `644`, 56 bytes, `815226c31a8ff4485f64ccaf9cbcd3d3a866105991aa5b03760c9890e9dae938`; |
| +- `SHA256SUMS.before`, root `600`, `34539e41…`: the eight files above, hashed at 22:52:40Z. |
| + |
| +**What was removed.** Only `CARLOS_HOST_CLAIM=1`. `/etc/carlos/claim-console.env` was swapped atomically (temp file, `mv`, guarded on the `5df17bac` hash) for 6.3's off form, the exact bytes `console-config` writes without the flag: `CARLOS_CONSOLE_ID=dev-console`, `CONSOLE_HOME_REGION=ie`, `CARLOS_HOST_CLAIM=` (root `600`, 72 bytes, `c1ae2900db31295090d2f4f2f9b5f6cdcca07e74545a6b1a9da039c3abf5c412`). The console ran in this state from 6.3 until 7.4. `console-config --dry-run` now accepts the file as its own: without the flag it plans the same bytes, and with `--enable-console-runtime` it plans the `=1` file, which is the resume. These are unchanged: `91-claim-runtime.conf`, `90-host-floor.conf` and the guard, `console.service`, `host.env`, every flag, leo, the roster, the floor. There was no `daemon-reload`, because no unit file changed. |
| + |
| +**Restart and checks.** `systemctl restart console.service` at 22:53:33Z, `active` the same second. A 1-second prober on `platform.dev…/healthz`, 22:53:24Z to 22:54:49Z, made 75 probes: one 502 at 22:53:33Z and 200 from 22:53:34Z. Afterwards, all PASS: |
| +- `/` and `/healthz` 200, `x-carlos-version: f3bf1214`. |
| +- The console has PID 653069, 0 restarts, and `exe` `/opt/carlos/system/console/console` as `carlos`. All four drop-ins are loaded, `90-host-floor.conf` included. Its environment has `CARLOS_HOST_CLAIM=` (empty) with `CARLOS_CONSOLE_ID=dev-console` and `CONSOLE_HOME_REGION=ie`. The guard directories are `755 root:root` and `sudo -u carlos test -x guard/carlos` passes. |
| +- The startup log no longer has the host-claim lines (0 matches for `off on a host-claim console` since the restart). The new startup lines are: `console: no console email (set CARLOS_CONSOLE_MAIL_FROM or CARLOS_MAIL_PLATFORM_SUFFIX, and CARLOS_MAIL_REGION); invites go by Keymail or by hand`, then `console: https://platform.dev.carlosframework.com listening on 127.0.0.1:8090`, then the known Cost Explorer lines. |
| +- wakecheck 200, and claimtrial 200 via `--resolve` to 18.200.150.210. |
| +- `carlos-edge` and `carlos-instance-control` are `active` with unchanged start times and PIDs: sophie since 07:50:46Z, leo since 07:51:53Z. |
| +- The bucket is unchanged. The roster is sha256 `20ebe512…` (revision 9, etag `a69f6d93…`, 19:35:16Z). The floor `moves-protocol.json` is `1a6a7e50…` and `moves-protocol-auth.json` is `3bbd48a8…` (19:33:45Z). |
| +- AccessDenied since 22:50Z: sophie 2, both `ce:GetCostAndUsage`; leo 0. |
| + |
| +**Resume.** Do this only on Paul's go, after the design note. Do it as 7.4, with the files put back first. From DOCS-T1, run `box_inspect "$SOPHIE"` (the box helpers) so `roster.json` and `rev` are current. Then on sophie, as root: |
| + |
| +```bash |
| +set -euo pipefail |
| +umask 077 |
| +D=/root/claim-trial/paused-20261019 |
| +[ "$(sha256sum /etc/carlos/claim-console.env | cut -c1-64)" = c1ae2900db31295090d2f4f2f9b5f6cdcca07e74545a6b1a9da039c3abf5c412 ] |
| +[ "$(sha256sum "$D/claim-console.env" | cut -c1-64)" = 5df17bac42a91a02d90584edc5476c045400af57e467b2ea0815ba50b7e31d03 ] |
| +[ "$(sha256sum "$D/91-claim-runtime.conf" | cut -c1-64)" = 815226c31a8ff4485f64ccaf9cbcd3d3a866105991aa5b03760c9890e9dae938 ] |
| +cmp "$D/91-claim-runtime.conf" /etc/systemd/system/console.service.d/91-claim-runtime.conf |
| +cp -p "$D/claim-console.env" /etc/carlos/.claim-console.env.resume |
| +mv -T /etc/carlos/.claim-console.env.resume /etc/carlos/claim-console.env |
| +cd /root/claim-trial |
| +PUB=$(cat release.pub) |
| +CID=$(cat console-id) |
| +REV=$(cat rev) |
| +/opt/carlos/carlos system claims console-config --roster /root/claim-trial/roster.json --expect-revision "$REV" \ |
| + --bucket carlos-dev-640012953448 --console-id "$CID" --public-key "$PUB" --enable-console-runtime --dry-run |
| +/opt/carlos/carlos system claims console-config --roster /root/claim-trial/roster.json --expect-revision "$REV" \ |
| + --bucket carlos-dev-640012953448 --console-id "$CID" --public-key "$PUB" --enable-console-runtime |
| +systemctl restart console.service |
| +systemctl is-active console.service |
| +``` |
| + |
| +The `cmp` line checks that the drop-in is still the saved bytes. It was never removed, so nothing needs restoring there. If the drop-in differs, or any hash line fails, that is a STOP. `console-config` rewrites the same `=1` bytes and reloads systemd. Then run 7.4's checks. `claim-console.env` is `5df17bac`, 73 bytes, root `600`. The console is `active`, running `/opt/carlos/system/console/console` as `carlos` with `CARLOS_HOST_CLAIM=1`, and its journal shows the run sweep and seeds pass lines again. Wait for `status/consoles/dev-console.json` to move, run `box_inspect "$SOPHIE"`, then run `console-report`'s dry run and apply as in 7.4. Finish with `/`, `/healthz` (`f3bf1214`), wakecheck and claimtrial at 200, and edge and instance-control on both boxes unrestarted. |
| + |
| Draft, first written 2026-10-16, revised 2026-10-17 against main at 26065378. Step 5.0a and step 6 were revised on 2026-10-18 against platform-1e's branch `claim-step6-artifacts` at `c38a4ca9`, and re-checked against main at `7c1beb2d` after it merged (published (v0.28.2, tag on 7c1beb2d)). Revised again on 2026-10-18 for the second signing session on v0.28.3, against main at `50f5b268` (`install-channel --policy`, from branch `claim-prev-rehearsal`) and the root-runner rehearsal of steps 6 and 7. Moved to v0.28.4 the same day, against main at `f3bf1214` (`install-channel --policy --identity`, from branch `claim-untagged-pointer`). It authorizes nothing. Every change below waits for Paul's go at its own checkpoint. Neither the approved copy quoted in step 8 nor the activation tools' tests authorize running anything. |