amadan
spec: host lifecycle claim rev 6.27, Paul's rulings on #236
New §1.1 records P1-P7 and the P5-D2 executor as ruled 2026-10-06: the floor; automatic termination fencing by a region placer bound to the roster's cloud identity (operator path for anything not proven terminated); the boxid-admitted roster; adoption per #232; choose() for the executor; limited placement; rename refused; cold-only admissions. §5.9, §6.6, §7.3 and §10.1 are ruled as amended by §1.1. Region HA's L1-L20 are not adopted yet.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+74
−10
docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md+74 −10
CI passed — run details
diff --git a/docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md b/docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md| index 9f9ab1088..a580637d5 100644 |
| --- a/docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md |
| +++ b/docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md |
| @@ -1,6 +1,6 @@ |
| # The host lifecycle claim |
| -Design, 2026-10-06, **rev 6.26**. Joint rounds 6 and 7 judged the claim ready for primitive planning. Rev |
| +Design, 2026-10-06, **rev 6.27**. Joint rounds 6 and 7 judged the claim ready for primitive planning. Rev |
| 6.5 added the R6-4 rule. Rev 6.6 added writer epochs (R7-1, amadan #225). |
| Rev 6.7 answered the moves session's notes on §6.4a. Rev 6.8 rewrote §6.4a |
| around writer sessions, for joint round 8. Rev 6.10 answers joint round 10 |
| @@ -26,7 +26,8 @@ joint round 16 (R16-1 scope namespaces, R16-3 the legacy loss identity) |
| and states the narrowed born-covered rule. Rev 6.25 answers the moves |
| spec's rev 7.17 notes (a delete's parks are scoped; a create's first |
| admission declares nothing). Rev 6.26 answers joint round 17's R17-2 (a |
| -delete may use the whole-host staging scope). Joint round 17 was CLEAN. Rev 6.9 answered |
| +delete may use the whole-host staging scope). Joint round 17 was CLEAN. Rev 6.27 records Paul's rulings on #236 |
| +(§1.1) and marks §5.9, §6.6, §7.3 and §10.1 ruled, as amended there. Rev 6.9 answered |
| joint round 9 |
| (R9-1 to R9-4) and takes **Paul's ruling R6 (2026-10-04): a box never |
| reuses its local database. Every writer start restores from the |
| @@ -103,6 +104,69 @@ The claim gives each host **one** record of: |
| Each of those actors must follow the rules below. |
| +### 1.1 Paul's rulings on the proposed contracts (2026-10-06, amadan #236) |
| + |
| +§5.9, §6.6, §7.3 and §10.1 were written as proposals. Paul ruled every open |
| +point on 2026-10-06. They are now **ruled, as amended by this section**; |
| +where this section and the proposal text differ, this section wins. |
| + |
| +- **P1, the floor (§10.1 D1).** The floor is the first tagged release that |
| + contains the finished claim and moves integrations, box identity |
| + (#212), the census, and the guarded boot and recovery paths. |
| +- **P2, declaring a box lost (§7.3 D2, D5).** Two paths: |
| + - **Automatic, for a box AWS reports `terminated`.** A region placer (a |
| + box with read-only EC2 rights; the console still holds none) writes |
| + the lost-box fence itself, with no person in the loop. The evidence |
| + (region HA spec 1 §5.9): the instance id, account and region come |
| + from the roster's `cloud` entry for that box, never from anything the |
| + box publishes; the state is exactly `terminated`; the observation |
| + comes from EventBridge or `DescribeInstances` (later, the Auto |
| + Scaling activity history). Absence from the EC2 API is never |
| + evidence. Fencing **execution** needs only that verified |
| + `terminated` read. The D5 destroyed-local exception (discharging a |
| + fenced box's `park-local` chores without retiring the disk) applies |
| + only when the same read's running-time volume records show every |
| + attached EBS volume `DeleteOnTermination: true`; otherwise those |
| + chores stay open on the operator path. |
| + - **Operator-attested, for anything not proven terminated** (`stopped`, |
| + unclear, missing from the EC2 API): D2 as written; the operator |
| + attests the maintained compute fence, a cold quarantine start, and, |
| + for the destroyed-local exception, destroyed storage. |
| +- **P3, the roster (§10.1 D7).** `control/host-actors.json` is the one |
| + roster; region HA drops its separate `control/boxes/<id>.json`. A box is |
| + admitted to it only with `internal/boxid` evidence (the AWS-signed IMDS |
| + document, checked against embedded regional certificates), and its |
| + entry records the account, region and instance id that evidence proves, |
| + in `cloud: {provider, account, region, instance_id}`. The box reference |
| + is the label key (#212 option B); the instance id is private roster |
| + data. Region HA's H16/H17 automatic Auto Scaling enrollment admits |
| + through the same evidence. |
| +- **P4, adoption (§5.9 P5-D2).** Superseded by Paul's #232 choice: one |
| + ownership record per hostname (`domains/<host>.json`); the claim keeps |
| + execution, parking and retirement, bound to the ownership acquisition's |
| + id, and is not a competing ownership authority. Adoption follows #232's |
| + backfill. |
| +- **P5-D2, the executor.** Create chooses the box with region HA spec 1's |
| + `choose()` over the roster's eligible set: prefer a box running no |
| + instance of this app; then the most headroom (until spec 2, the fewest |
| + claimed hosts); then SHA-256 of `host + "\x00" + box reference` as the |
| + final tie-break. The choice is recorded once, in the create intent, and |
| + recovery never substitutes another box. |
| +- **P5, placement (§5.9 P5-D5).** Limited scope: with `CARLOS_HOST_CLAIM` |
| + on, only record-backed placement is allowed; anything that cannot yet |
| + transfer is refused whole, never half-updated. Stateful fleet transfer |
| + gets its own spec. |
| +- **P6, rename and account transfer (§5.9 P5-D6).** Refused for |
| + record-backed hosts until a transfer protocol exists. |
| +- **P7, cold-only admissions (§6.6 P6-D4).** Allowed: once the other |
| + activation gates pass, every admission is cold, warm admission is |
| + disabled and no clean-close certificate is issued, until a reviewed |
| + Litestream fix or upgrade (#234) makes a certificate safe. Revisit then. |
| + |
| +Region HA spec 1 rev 5.4 asks for further claim changes (its §9, L1 to |
| +L20, including a same-region `relocating` op kind). They are not part of |
| +this spec until answered on #236 and adopted in a later revision. |
| + |
| ## 2. The object |
| `control/hosts/<host>.json` in the control (deployment) bucket. It is |
| @@ -640,9 +704,9 @@ is an operation, `placing`. Its CAS from `serving` comes **before** any |
| app, registry or record write, with the target in `intent`. The pass |
| replays it. Moves and placements therefore exclude each other. |
| -### 5.9 Console operation contracts (rev 6.18, PROPOSED) |
| +### 5.9 Console operation contracts (rev 6.18, RULED, as amended by §1.1) |
| -**Status: proposed, not yet ruled.** These close the gaps Plan 5's draft found (P5-D1 to P5-D6). Each says where it would land in §2, §5, §6, §8 and §9 once ruled, and how amadan #232 (host ownership; Paul decides its direction) would change it. Paul's decisions are listed in amadan #236. |
| +**Status: ruled 2026-10-06, as amended by §1.1 (originally proposed).** These close the gaps Plan 5's draft found (P5-D1 to P5-D6). Each says where it would land in §2, §5, §6, §8 and §9 once ruled, and how amadan #232 (host ownership; Paul decides its direction) would change it. Paul's decisions are listed in amadan #236. |
| The text below depends on the proposed §7.3 and §10.1 contracts. It does not treat them as approved. The referenced #212 design is also unsettled: its current header recommends an alternative and records unresolved review findings. |
| @@ -1922,9 +1986,9 @@ key. The console needs `s3:GetObjectVersion`. |
| Delete step 1 also stops accepting new door requests for the host, on |
| every console. But safety does not depend on draining them. |
| -### 6.6 Box-side contracts (rev 6.19, PROPOSED) |
| +### 6.6 Box-side contracts (rev 6.19, RULED, as amended by §1.1) |
| -**Status: proposed, not yet ruled.** These close the gaps Plan 6's draft found (P6-D1 to P6-D8). They reference the proposed §5.9, §7.3 and §10.1 as dependencies, not as approved text. Paul's decisions are listed in amadan #236. Not yet read against amadan #234's discussion text (the certificate analysis rests on the pinned Litestream v0.5.14 source). |
| +**Status: ruled 2026-10-06, as amended by §1.1 (originally proposed).** These close the gaps Plan 6's draft found (P6-D1 to P6-D8). They reference the proposed §5.9, §7.3 and §10.1 as dependencies, not as approved text. Paul's decisions are listed in amadan #236. Not yet read against amadan #234's discussion text (the certificate analysis rests on the pinned Litestream v0.5.14 source). |
| #### P6-D1. Privileged stop collection and durable evidence |
| @@ -2342,9 +2406,9 @@ only while an operation is running. A host that is simply serving holds |
| no execution leases, so a control-bucket outage cannot stop serving |
| traffic. |
| -### 7.3 Contracts for leases, lost boxes and the floor (rev 6.17, PROPOSED) |
| +### 7.3 Contracts for leases, lost boxes and the floor (rev 6.17, RULED, as amended by §1.1) |
| -**Status: proposed, not yet ruled.** These contracts close the gaps Plan 8's draft found (D2 to D6). They are under joint review and wait on Paul's rulings P1 to P3 in §10.1; nothing in production relies on them until then. Missing safety evidence always means unsupported or unknown, never success; all new JSON fields are additive. |
| +**Status: ruled 2026-10-06, as amended by §1.1 (originally proposed).** These contracts close the gaps Plan 8's draft found (D2 to D6). They are under joint review and wait on Paul's rulings P1 to P3 in §10.1; nothing in production relies on them until then. Missing safety evidence always means unsupported or unknown, never success; all new JSON fields are additive. |
| #### D2. Fencing evidence binding and transport |
| @@ -2767,9 +2831,9 @@ because the instance is new. |
| `carlos ops host resolve` runs. That is visible and safe. |
| - **IAM:** the versioned-object grants in §6.2 and §6.5. |
| -### 10.1 Release identity, the census and actor membership (rev 6.17, PROPOSED) |
| +### 10.1 Release identity, the census and actor membership (rev 6.17, RULED, as amended by §1.1) |
| -**Status: proposed, not yet ruled.** D1 and D7 extend the floor from a protocol number to authenticated release identities, a persistent pre-exec guard on the system update path, and a root-signed actor directory with lifecycle and executable-activation reservations. They change the platform's update and membership machinery beyond the claim, so they wait on Paul: |
| +**Status: ruled 2026-10-06, as amended by §1.1 (originally proposed).** D1 and D7 extend the floor from a protocol number to authenticated release identities, a persistent pre-exec guard on the system update path, and a root-signed actor directory with lifecycle and executable-activation reservations. They change the platform's update and membership machinery beyond the claim, so they wait on Paul: |
| - **P1 (D1):** which real release becomes the floor (recommended: the first tagged release containing the completed claim and moves integrations, box identity, the census and the guarded boot and recovery paths). |
| - **P2 (D2):** the operator attestation boundary for declare-lost (recommended: operators attest the maintained compute fence, cold quarantine start and destroyed storage; the console does not independently verify cloud state). |