amadan
census: edge request records, approved by the census owner (census-ruling-edge-request-records)
Root-read census (#369): the four new units Paul approved in session on
2026-10-25 ("Approve all four (Recommended)") are hand-written in
plan14-root-reads-edge-request-records-decisions.tsv: Edge.observeRecords,
Edge.recordMatch and requestResponse (J1 root-route, the route row the edge
already resolved) and reqrec.NewRef (crypto/rand.Read of the code's nonce).
census-propose wrote the approvals overlay for the six changed units and
six envelopes, and the card at
docs/superpowers/notes/census-proposal-edge-request-records.md.
Record-write census (9B8): registerCLIRoutes re-digested after the merge
of main (be9a3119); it is main's body plus this branch's one edge-refs
route line, kinds unchanged. The layer now names wakeLatency3 as its base.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
5 files changed,
+123
−3
docs/superpowers/notes/census-proposal-edge-request-records.md+85 −0internal/provision/edge_request_records_census_test.go+3 −3internal/provision/testdata/plan14-root-reads-chain.tsv+2 −0internal/provision/testdata/plan14-root-reads-edge-request-records-decisions.tsv+14 −0internal/provision/testdata/plan14-root-reads-edge-request-records.tsv+19 −0
CI passed — run details
CI log
=== gate ===
.amadan/test-gate.sh
=== launchctx (1 s)
ok amadan.net/carlos/platform.git/launchctx 0.017s
? amadan.net/carlos/platform.git/launchctx/controlname [no test files]
? amadan.net/carlos/platform.git/launchctx/wireid [no test files]
=== vet (14 s)
=== gofmt (1 s)
gofmt -l .: clean
=== rest (69 s)
? github.com/carlosframework/platform/cmd/changelog [no test files]
ok github.com/carlosframework/platform/cmd/console 3.739s
ok github.com/carlosframework/platform/cmd/moveprobe 11.912s
ok github.com/carlosframework/platform/cmd/zddprobe 0.794s
ok github.com/carlosframework/platform/internal/activator 59.086s
ok github.com/carlosframework/platform/internal/agentsock 0.026s
ok github.com/carlosframework/platform/internal/alerting 0.009s
ok github.com/carlosframework/platform/internal/analytics 0.052s
ok github.com/carlosframework/platform/internal/appconfig 2.980s
ok github.com/carlosframework/platform/internal/apperr 0.126s
ok github.com/carlosframework/platform/internal/applog 0.258s
ok github.com/carlosframework/platform/internal/assetcache 0.247s
ok github.com/carlosframework/platform/internal/awsinv 0.015s
ok github.com/carlosframework/platform/internal/boxchoice 0.008s
ok github.com/carlosframework/platform/internal/boxid 0.953s
? github.com/carlosframework/platform/internal/boxid/boxidtest [no test files]
? github.com/carlosframework/platform/internal/boxid/internal/signtest [no test files]
ok github.com/carlosframework/platform/internal/boxvolumes 0.011s
ok github.com/carlosframework/platform/internal/caps 0.023s
ok github.com/carlosframework/platform/internal/certwarm 0.004s
ok github.com/carlosframework/platform/internal/cgroup 0.809s
ok github.com/carlosframework/platform/internal/changelog 0.602s
ok github.com/carlosframework/platform/internal/claimactivation 1.136s
ok github.com/carlosframework/platform/internal/clamd 0.063s
? github.com/carlosframework/platform/internal/cliflag [no test files]
? github.com/carlosframework/platform/internal/controlname [no test files]
? github.com/carlosframework/platform/internal/controlsock [no test files]
ok github.com/carlosframework/platform/internal/dbdoor 7.631s
ok github.com/carlosframework/platform/internal/dbdoor/dbdoortest 0.022s
ok github.com/carlosframework/platform/internal/dbquery 0.014s
ok github.com/carlosframework/platform/internal/dbreads 2.229s
? github.com/carlosframework/platform/internal/dbreads/dbreadstest [no test files]
ok github.com/carlosframework/platform/internal/dbverify 0.007s
ok github.com/carlosframework/platform/internal/dnsrec 0.012s
ok github.com/carlosframework/platform/internal/docsite 0.014s
ok github.com/carlosframework/platform/internal/domains 2.840s
ok github.com/carlosframework/platform/internal/doorkey 0.013s
ok github.com/carlosframework/platform/internal/economics 0.008s
ok github.com/carlosframework/platform/internal/edge 45.618s
? github.com/carlosframework/platform/internal/edgeproof [no test files]
ok github.com/carlosframework/platform/internal/edgesfile 0.015s
ok github.com/carlosframework/platform/internal/fleetapi 0.237s
ok github.com/carlosframework/platform/internal/gate 1.745s
ok github.com/carlosframework/platform/internal/genselect 0.022s
ok github.com/carlosframework/platform/internal/geo 0.023s
ok github.com/carlosframework/platform/internal/geoip 0.056s
ok github.com/carlosframework/platform/internal/historyreadback 0.306s
ok github.com/carlosframework/platform/internal/hostactors 6.046s
ok github.com/carlosframework/platform/internal/hostactors/awsmembership 0.019s
ok github.com/carlosframework/platform/internal/hostbox 2.946s
ok github.com/carlosframework/platform/internal/hostclaim 0.750s
ok github.com/carlosframework/platform/internal/hostenv 0.013s
ok github.com/carlosframework/platform/internal/hostevidence 0.013s
ok github.com/carlosframework/platform/internal/hostexec 5.243s
ok github.com/carlosframework/platform/internal/hostfence 0.080s
ok github.com/carlosframework/platform/internal/hostfiles 10.504s
ok github.com/carlosframework/platform/internal/hostfloor 0.046s
ok github.com/carlosframework/platform/internal/hostguard 1.054s
ok github.com/carlosframework/platform/internal/hostops 1.866s
? github.com/carlosframework/platform/internal/hostops/fencerelease [no test files]
ok github.com/carlosframework/platform/internal/hostops/internal/fencerelease 0.007s
ok github.com/carlosframework/platform/internal/hostquarantine 0.006s
ok github.com/carlosframework/platform/internal/hostrelocate 0.599s
ok github.com/carlosframework/platform/internal/hostresolve 0.207s
ok github.com/carlosframework/platform/internal/hostwrite 0.004s
ok github.com/carlosframework/platform/internal/infraview 0.005s
ok github.com/carlosframework/platform/internal/instancectl 5.256s
ok github.com/carlosframework/platform/internal/instanceexec 2.911s
ok github.com/carlosframework/platform/internal/instancefs 0.011s
ok github.com/carlosframework/platform/internal/instancekey 0.007s
ok github.com/carlosframework/platform/internal/instanceupdates 0.009s
ok github.com/carlosframework/platform/internal/layout 1.685s
ok github.com/carlosframework/platform/internal/lbhealth 0.005s
ok github.com/carlosframework/platform/internal/lease 10.158s
ok github.com/carlosframework/platform/internal/lease/leasetest 0.501s
ok github.com/carlosframework/platform/internal/ledger 0.017s
ok github.com/carlosframework/platform/internal/mail 0.276s
ok github.com/carlosframework/platform/internal/maintenance 0.114s
ok github.com/carlosframework/platform/internal/maintenanceexec 5.580s
ok github.com/carlosframework/platform/internal/maintenanceguard 0.137s
ok github.com/carlosframework/platform/internal/metrics 0.011s
ok github.com/carlosframework/platform/internal/moves 23.031s
ok github.com/carlosframework/platform/internal/moves/archive 0.982s
ok github.com/carlosframework/platform/internal/objstore 0.276s
ok github.com/carlosframework/platform/internal/ops 0.259s
ok github.com/carlosframework/platform/internal/park 0.265s
ok github.com/carlosframework/platform/internal/plans 0.008s
ok github.com/carlosframework/platform/internal/privatefile 0.004s
ok github.com/carlosframework/platform/internal/provision 23.727s
ok github.com/carlosframework/platform/internal/publicrelease 0.008s
? github.com/carlosframework/platform/internal/regionname [no test files]
ok github.com/carlosframework/platform/internal/registry 5.596s
ok github.com/carlosframework/platform/internal/relay 7.253s
ok github.com/carlosframework/platform/internal/release 26.353s
ok github.com/carlosframework/platform/internal/reqrec 5.844s
ok github.com/carlosframework/platform/internal/rollout 3.781s
ok github.com/carlosframework/platform/internal/rolloutwords 0.003s
ok github.com/carlosframework/platform/internal/rootaws 0.007s
ok github.com/carlosframework/platform/internal/rootparticipation 0.058s
ok github.com/carlosframework/platform/internal/rootstate 0.026s
ok github.com/carlosframework/platform/internal/runs 0.585s
ok github.com/carlosframework/platform/internal/s3compat 0.006s
ok github.com/carlosframework/platform/internal/safefile 0.004s
ok github.com/carlosframework/platform/internal/schedule 2.583s
ok github.com/carlosframework/platform/internal/seeds 0.011s
ok github.com/carlosframework/platform/internal/sim/engines 2.154s
ok github.com/carlosframework/platform/internal/sim/hostlife 9.909s
ok github.com/carlosframework/platform/internal/sim/litestreamfacts 3.893s
ok github.com/carlosframework/platform/internal/status 0.066s
ok github.com/carlosframework/platform/internal/steering 0.007s
ok github.com/carlosframework/platform/internal/stopevidence 0.142s
ok github.com/carlosframework/platform/internal/svcrole 0.002s
ok github.com/carlosframework/platform/internal/telemetry 0.004s
ok github.com/carlosframework/platform/internal/termfence 0.004s
ok github.com/carlosframework/platform/internal/tunnelclient 0.006s
ok github.com/carlosframework/platform/internal/unixdial 0.003s
ok github.com/carlosframework/platform/internal/updatewords 0.004s
ok github.com/carlosframework/platform/internal/usage 0.009s
ok github.com/carlosframework/platform/internal/version 0.002s
ok github.com/carlosframework/platform/internal/vet 1.576s
=== internal_console@0 (69 s)
ok github.com/carlosframework/platform/internal/console 67.203s
=== internal_console@1 (50 s)
ok github.com/carlosframework/platform/internal/console 48.326s
=== internal_console@2 (44 s)
ok github.com/carlosframework/platform/internal/console 42.993s
=== internal_console@3 (41 s)
ok github.com/carlosframework/platform/internal/console 39.856s
=== internal_console@4 (44 s)
ok github.com/carlosframework/platform/internal/console 42.458s
=== internal_console@5 (43 s)
ok github.com/carlosframework/platform/internal/console 41.406s
=== internal_console@6 (46 s)
ok github.com/carlosframework/platform/internal/console 44.534s
=== internal_console@7 (48 s)
ok github.com/carlosframework/platform/internal/console 46.772s
=== internal_host@0 (33 s)
ok github.com/carlosframework/platform/internal/host 31.081s
=== internal_host@1 (31 s)
ok github.com/carlosframework/platform/internal/host 28.966s
=== internal_host@2 (29 s)
ok github.com/carlosframework/platform/internal/host 27.492s
=== internal_host@3 (62 s)
ok github.com/carlosframework/platform/internal/host 60.432s
=== root@0 (70 s)
ok github.com/carlosframework/platform 68.754s
=== root@1 (49 s)
ok github.com/carlosframework/platform 47.971s
=== root@2 (61 s)
ok github.com/carlosframework/platform 59.885s
=== root@3 (52 s)
ok github.com/carlosframework/platform 50.495s
=== root@4 (55 s)
ok github.com/carlosframework/platform 53.553s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
linux/arm64 carlos binary: 50790562 bytes (ceiling 52000000)
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
minio: cached, digest verified
mc: cached, digest verified
minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
buckets and scoped user ready
=== RUN TestDeliveredContractMinio
=== RUN TestDeliveredContractMinio/put
=== RUN TestDeliveredContractMinio/get_round-trips_the_body
=== RUN TestDeliveredContractMinio/list_shows_the_key
=== RUN TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN TestDeliveredContractMinio/delete_removes_it
=== RUN TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
--- PASS: TestDeliveredContractMinio/put (0.00s)
--- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
--- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
--- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
--- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok github.com/carlosframework/platform/internal/objstore 0.024s
=== RUN TestT4StorageProbeMinio
2026/10/25 07:09:01 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18E1B417D7543FAA, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.01s)
PASS
ok github.com/carlosframework/platform/internal/host 0.021s
=== RUN TestS3StoreMinioContract
=== RUN TestS3StoreMinioContract/conditional_get_and_etag_listing
=== RUN TestS3StoreMinioContract/bump_through_every_mutation_path
--- PASS: TestS3StoreMinioContract (0.02s)
--- PASS: TestS3StoreMinioContract/conditional_get_and_etag_listing (0.01s)
--- PASS: TestS3StoreMinioContract/bump_through_every_mutation_path (0.01s)
PASS
ok github.com/carlosframework/platform/internal/release 0.029s
Bucket created successfully `local/dbf-deploy`.
Bucket created successfully `local/dbf-data-ie`.
Bucket created successfully `local/dbf-data-uk`.
local/dbf-deploy versioning is enabled
Created policy `dbf-console` successfully.
Created policy `dbf-ukbox` successfully.
Added user `dbfconsole` successfully.
Added user `dbfukbox` successfully.
Attached Policies: [dbf-console]
To User: dbfconsole
Attached Policies: [dbf-ukbox]
To User: dbfukbox
=== RUN TestDBForwardMinio
2026/10/25 07:09:03 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/25 07:09:03 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/25 07:09:03 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/25 07:09:03 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/25 07:09:03 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/25 07:09:03 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/25 07:09:03 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/25 07:09:03 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/25 07:09:03 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/25 07:09:03 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/25 07:09:03 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/25 07:09:03 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
2026/10/25 07:09:03 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 07:09:03 console: could not notify member@example.com of a CLI token issue: keymail: lookup member@example.com: keymail: GET /api/federation/lookup?addr=member%40example.com&from=console%40127.0.0.1%3A35033: could not determine target mailbox
agent.go:135: dbreads: dbr_mihevr2ehnbwvfy5e6rvzdtbxu: planned 3 files (1544 bytes) and restored to 3 in 9ms
agent.go:135: dbreads: dbr_mihevr2ehnbwvfy5e6rvzdtbxu: output 5 bytes in 1 confirmed chunks in 1ms
2026/10/25 07:09:04 console: db read dbr_mihevr2ehnbwvfy5e6rvzdtbxu: relayed 1 chunks (102 bytes) in 1.004s, ended done
agent.go:135: dbreads: dbr_w4qdys36xxvz45u2cpqoht336m: planned 1 files (720 bytes) and restored to 1 in 7ms
agent.go:135: dbreads: dbr_w4qdys36xxvz45u2cpqoht336m: output 5 bytes in 1 confirmed chunks in 1ms
2026/10/25 07:09:05 console: db read dbr_w4qdys36xxvz45u2cpqoht336m: relayed 1 chunks (102 bytes) in 1.003s, ended done
agent.go:135: dbreads: dbr_x5yjylvwypphkkyndihupermle: planned 3 files (1544 bytes) and held through 3 in 8ms
agent.go:135: dbreads: dbr_x5yjylvwypphkkyndihupermle: output 1544 bytes in 1 confirmed chunks in 1ms
2026/10/25 07:09:06 console: db read dbr_x5yjylvwypphkkyndihupermle: relayed 1 chunks (1641 bytes) in 1.004s, ended done
=== RUN TestDBForwardMinio/by_disconnect
=== NAME TestDBForwardMinio
agent.go:135: dbreads: dbr_zyphow7d6qr3mwnxk6vmffnloi: planned 3 files (1544 bytes) and restored to 3 in 9ms
2026/10/25 07:09:06 console: db read dbr_zyphow7d6qr3mwnxk6vmffnloi: relayed 0 chunks (0 bytes) in 26ms, ended client gone
agent.go:135: dbreads: dbr_zyphow7d6qr3mwnxk6vmffnloi: output 5 bytes in 1 confirmed chunks in 34ms
=== RUN TestDBForwardMinio/by_timeout
=== NAME TestDBForwardMinio
agent.go:135: dbreads: dbr_sdzhc665s2vaheqdxxfwhqqtpi: planned 3 files (1544 bytes) and restored to 3 in 10ms
2026/10/25 07:09:26 console: db read dbr_sdzhc665s2vaheqdxxfwhqqtpi: relayed 0 chunks (0 bytes) in 19.249s, ended no-result
agent.go:135: dbreads: dbr_sdzhc665s2vaheqdxxfwhqqtpi: output 5 bytes in 1 confirmed chunks in 19.22s
--- PASS: TestDBForwardMinio (22.62s)
--- PASS: TestDBForwardMinio/by_disconnect (0.17s)
--- PASS: TestDBForwardMinio/by_timeout (19.36s)
PASS
ok github.com/carlosframework/platform/internal/console 22.635s
minio contract: PASS
diff --git a/docs/superpowers/notes/census-proposal-edge-request-records.md b/docs/superpowers/notes/census-proposal-edge-request-records.md| new file mode 100644 |
| index 000000000..b67e7e3a5 |
| --- /dev/null |
| +++ b/docs/superpowers/notes/census-proposal-edge-request-records.md |
| @@ -0,0 +1,85 @@ |
| +# Census approval: edge-request-records (branch design-edge-request-protection) |
| + |
| +Approved by Paul (census owner), in session, 2026-10-25 (AskUserQuestion: |
| +"Approve all four (Recommended)"), for the four decision rows below. The |
| +approvals table at the end is census-propose's own: each of those units keeps |
| +the disposition it already has. |
| + |
| +Ruling `census-ruling-edge-request-records`. Every row already carries it |
| +(#369). Branch `design-edge-request-protection`, Plan 1 of |
| +`docs/superpowers/specs/2026-10-24-edge-request-protection-design.md`: edge |
| +request records (sampled 404 and rule-match records, per-minute counts, and |
| +the block page's reference code). No root read is added. Every unit below |
| +runs in the edge inside the agent (`carlos agent`, `carlos-edge.service`, |
| +user `carlos`), never as root. |
| + |
| +## What you are asked |
| + |
| +- **Approvals (12): 6 changed units and 6 envelopes.** 5 are `body` changes |
| + and 1 is `sites`: `Edge.ServeHTTP` has one more `whole:Route` read, the |
| + route its observer defer already holds, passed to `observeRecords`. |
| + census-propose wrote these rows into |
| + `plan14-root-reads-edge-request-records.tsv`. Their table is under |
| + "Approvals" below. |
| +- **Decisions (4): 4 new units.** census-propose cannot write these. They |
| + are hand-written in `plan14-root-reads-edge-request-records-decisions.tsv`, |
| + which loads before the approvals overlay. Each new unit is accepted legacy |
| + at the class of the row it mirrors: |
| + |
| + | decision | unit | disposition | mirrors | reads | digest | |
| + |---|---|---|---|---|---| |
| + | new | `internal/edge/reqrecords.go` `Edge.observeRecords` | legacy, accepted-legacy (J1 root-route) | `Edge.observeAnalytics` | `whole:Route@491`, the route the observer defer passes in. It files one Response into the in-memory recorder; it skips tunnel-delivered requests (the forwarding box records them) | `63bfaff2…0a87` | |
| + | new | `internal/edge/reqrecords.go` `Edge.recordMatch` | legacy, accepted-legacy (J1 root-route) | `Edge.observeAnalytics` | `whole:Route@327`, the route passed in. It mints the reference code with the mesh key the edge already holds in memory, then files a Match. No production caller in Plan 1: Plan 2's rules call it | `423c62d0…9ba9` | |
| + | new | `internal/edge/reqrecords.go` `requestResponse` | legacy, accepted-legacy (J1 root-route) | `Edge.emitEdgeError`, `UsageMeter.Record` | `whole:Route@182`, `registry:App@192`, `registry:Host@206`, `registry:Environment@228`: fields of the route row the edge already resolved. The account and app come from that row, never the Host header. A pure constructor | `ce22da9c…74fd` | |
| + | new | `internal/reqrec/ref.go` `NewRef` | legacy, accepted-legacy (J4 root-input) | `mintMeshKey`, `dbreads nonce` (census-ruling-db-region-forward-1) | `file:Read@484`, which is `crypto/rand.Read` of the code's 8-byte nonce, not a file. The code is a reference the owner looks up, never an authorization | `a2e27bb0…09c8` | |
| + |
| +- **Record-write census (9B8): 1 entry re-digested, class and kinds |
| + unchanged** (`internal/provision/edge_request_records_census_test.go`, |
| + hand-written as 9B8 still requires). `registerCLIRoutes` (key-site) is |
| + main's body plus one route line: `GET .../edge-refs/{code}` on the logs |
| + read's gate and roles. The handler only reads. Nothing in this plan writes |
| + an instance or sidecar record. |
| + |
| +## History |
| + |
| +Paul approved the four decisions on the dry-run card, before the masking |
| +round (`internal/reqrec/redact.go`, e48b542f and 7fdb1a83) and before main |
| +was merged in (be9a3119). This card was regenerated after both. It shows the |
| +same four decisions with the same reads, and the same six approvals. The |
| +masking round moved only the `internal/reqrec` envelope. The merge moved |
| +`registerCLIRoutes`'s 9B8 digest, since main changed the run doors in the |
| +same function. |
| + |
| +## Seal |
| + |
| +The chain ends at main's `wake-latency-3`: `86570d13…5a98`. |
| + |
| +- The decisions overlay adds four frozen declarations: |
| + `3b39ad97f7d5cc63967bb0ac586af2f395864e885a5c94a1fa4a6b9a7af68be0`. |
| +- The approvals overlay re-freezes five: |
| + `4094971bef61fb49310fff122d074ac71ddc670296d159d5b05f41ad1e917fbb`. |
| + |
| +Both lines are in `plan14-root-reads-chain.tsv`, after main's. |
| + |
| +Re-running `make census-propose NAME=edge-request-records` rewrites the |
| +section below and replaces this whole file. Restore the sections above |
| +after a re-run. |
| + |
| +## Approvals (written by census-propose) |
| + |
| +Ruling `census-ruling-edge-request-records`. Every change below keeps the disposition it already has, so it needs an approval, not a decision. |
| + |
| +| unit | change | read sites | what changed | |
| +|---|---|---|---| |
| +| `internal/activator/activator.go` `Service.begin` | body | unchanged (6) | gains a req *http.Request parameter and one edge.MarkWoke(req) call on the path that starts a wake, so the edge's request record can say which request woke the app; no read added | |
| +| `internal/activator/activator.go` `Service.beginRequest` | body | unchanged (1) | passes nil for begin's new req parameter; no read added | |
| +| `internal/activator/activator.go` `Service.serve` | body | unchanged (16) | passes the member request r to begin's new req parameter; no read added | |
| +| `internal/activator/cmd.go` `Service.RunCmd` | body | unchanged (8) | passes nil for begin's new req parameter; no read added | |
| +| `internal/host/agent.go` `runAgent` | body | unchanged (5) | builds the edge request recorder against the existing log sink and data dir (newRequestRecorder, passed os.Getenv and time.Now) and starts reqrecLoop on a minute ticker; no read added | |
| +| `internal/edge/edge.go` `Edge.ServeHTTP` | sites | +whole:Route | one more call in the observer defer, observeRecords(up.route, ...), passing on the route the defer already holds; no new kind of read | |
| + |
| +Envelopes re-pinned: `internal/activator`, `internal/applog`, `internal/console`, `internal/edge`, `internal/host`, `internal/reqrec`. |
| + |
| +Seal: `3b39ad97f7d5cc63967bb0ac586af2f395864e885a5c94a1fa4a6b9a7af68be0` → `4094971bef61fb49310fff122d074ac71ddc670296d159d5b05f41ad1e917fbb`. |
| + |
| +Overlay: `internal/provision/testdata/plan14-root-reads-edge-request-records.tsv`, appended to `internal/provision/testdata/plan14-root-reads-chain.tsv`. |
diff --git a/internal/provision/edge_request_records_census_test.go b/internal/provision/edge_request_records_census_test.go| index f66369cbf..baddbd216 100644 |
| --- a/internal/provision/edge_request_records_census_test.go |
| +++ b/internal/provision/edge_request_records_census_test.go |
| @@ -2,8 +2,8 @@ package provision |
| // Record-write census entries for edge request records (Plan 1 of |
| // docs/superpowers/specs/2026-10-24-edge-request-protection-design.md), |
| -// layered on secSidecarCreateGateWriteCensusInventory (main's last at |
| -// b612e710, the branch base). registerCLIRoutes gains one route line, the |
| +// layered on wakeLatency3WriteCensusInventory (main's last layer at the |
| +// merge be9a3119). registerCLIRoutes is main's body plus one route line, the |
| // edge reference code read (GET .../edge-refs/{code}, apiedgeref.go), on the |
| // logs read's gate and roles. The handler only reads: the mesh key to verify |
| // the code and the app's log chunks to find the record. Edge request records |
| @@ -13,7 +13,7 @@ package provision |
| func edgeRequestRecordsWriteCensusInventory() []censusEntry { |
| entries := append([]censusEntry(nil), wakeLatency3WriteCensusInventory()...) |
| replacements := []censusEntry{ |
| - {"internal/console/authcli.go", "Server.registerCLIRoutes", "key-site", "lit:instances,lit:sidecars", "4373eafcf395dbc4b593d527e018ed70e0a09d8bddc2b5599f03a597b920e6d7"}, |
| + {"internal/console/authcli.go", "Server.registerCLIRoutes", "key-site", "lit:instances,lit:sidecars", "b4c66adfdd02dde0baec80d32f3961d5635ce92fd766dd6deb381700584aec17"}, |
| } |
| for _, r := range replacements { |
| found := false |
diff --git a/internal/provision/testdata/plan14-root-reads-chain.tsv b/internal/provision/testdata/plan14-root-reads-chain.tsv| index 671a7bc0d..29745d062 100644 |
| --- a/internal/provision/testdata/plan14-root-reads-chain.tsv |
| +++ b/internal/provision/testdata/plan14-root-reads-chain.tsv |
| @@ -10,3 +10,5 @@ plan14-root-reads-edge-asset-cache-2.tsv de15b849fcb93b76caca55be924cde41512f8c4 |
| plan14-root-reads-pro-6214-service-runs-decisions.tsv ec2d8daaec385b34b3be9c8c6430427c082ac36cd40150e1c6f520e20e3da72d |
| plan14-root-reads-pro-6214-service-runs.tsv 86570d1326baad6d866b4066b6bf65218434b201fb1f2c05ebc6e3c79f9c5a98 |
| plan14-root-reads-wake-latency-3.tsv 86570d1326baad6d866b4066b6bf65218434b201fb1f2c05ebc6e3c79f9c5a98 |
| +plan14-root-reads-edge-request-records-decisions.tsv 3b39ad97f7d5cc63967bb0ac586af2f395864e885a5c94a1fa4a6b9a7af68be0 |
| +plan14-root-reads-edge-request-records.tsv 4094971bef61fb49310fff122d074ac71ddc670296d159d5b05f41ad1e917fbb |
diff --git a/internal/provision/testdata/plan14-root-reads-edge-request-records-decisions.tsv b/internal/provision/testdata/plan14-root-reads-edge-request-records-decisions.tsv| new file mode 100644 |
| index 000000000..c0b052225 |
| --- /dev/null |
| +++ b/internal/provision/testdata/plan14-root-reads-edge-request-records-decisions.tsv |
| @@ -0,0 +1,14 @@ |
| +# Census overlay edge-request-records-decisions, written BY HAND (AGENTS.md, The census: census-propose refuses decisions). The decisions of census-ruling-edge-request-records (branch design-edge-request-protection, Plan 1 of docs/superpowers/specs/2026-10-24-edge-request-protection-design.md: edge request records): four new units. Loaded from the chain manifest before plan14-root-reads-edge-request-records.tsv, which census-propose wrote for the approvals. Approved by the census owner, Paul, on 2026-10-25 in session ("Approve all four (Recommended)"); the card is docs/superpowers/notes/census-proposal-edge-request-records.md; rows carry the ruling from the start (#369). |
| +# No root read is added. All four units run in the edge inside the agent (carlos-edge.service, user carlos), never as root; three read only the route row the edge already resolved for the request, and NewRef reads crypto/rand. Each new unit is accepted legacy at the class of the row it mirrors, named in its basis. Four frozen declarations are added, so the seal moves. |
| +# NEW, root-route (the observer defer): files one edge request record per served response. Mirrors Edge.observeAnalytics (J1 root-route), which runs just before it in the same defer. |
| +@legacy aac0afc4ba86b1d95356439b6583569f58271b064bfa19e6b4eef78096de212c internal/edge/reqrecords.go Edge.observeRecords legacy accepted-legacy accepted-legacy;rev3=census-ruling-edge-request-records;identity=the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=new: called from ServeHTTP's observer defer after observeAnalytics, with the route the defer already holds; returns at once when no recorder is wired or the request arrived over a tunnel (the forwarding box records it); otherwise builds the Response through requestResponse from that route and the request and hands it to the in-memory recorder, which files it into the box's log sink; its one scanned site is the route value passed in; it reads no file, no store and no box state, writes nothing outside the log sink, and makes no serving or root decision; the class of Edge.observeAnalytics (J1 root-route) whole:Route@491 63bfaff25532548c1aaee23cab2538bfacc8d56cf5410a34276ba92cf1fb0a87 |
| +internal/edge/reqrecords.go Edge.observeRecords legacy accepted-legacy accepted-legacy;rev3=census-ruling-edge-request-records;identity=the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=new: called from ServeHTTP's observer defer after observeAnalytics, with the route the defer already holds; returns at once when no recorder is wired or the request arrived over a tunnel (the forwarding box records it); otherwise builds the Response through requestResponse from that route and the request and hands it to the in-memory recorder, which files it into the box's log sink; its one scanned site is the route value passed in; it reads no file, no store and no box state, writes nothing outside the log sink, and makes no serving or root decision; the class of Edge.observeAnalytics (J1 root-route) whole:Route@491 63bfaff25532548c1aaee23cab2538bfacc8d56cf5410a34276ba92cf1fb0a87 |
| +# NEW, root-route: files a protection-rule match and returns the block page's reference code. No production caller in Plan 1; Plan 2's rule checks call it. Mirrors Edge.observeAnalytics. |
| +@legacy fa3670b5f980a81db08bcdb91bf42fe04904d9fe066efe204ed22ea712797b32 internal/edge/reqrecords.go Edge.recordMatch legacy accepted-legacy accepted-legacy;rev3=census-ruling-edge-request-records;identity=the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=new: mints the block page's reference code with reqrec.NewRef from the time, the rule tier and id, this box's name and the current mesh key the edge already holds in memory (homes.meshKeys; nil when this box has none, giving an unsealed code), then, when a recorder is wired, files a Match built through requestResponse from the route passed in; its one scanned site is that route value; no production caller in Plan 1 (Plan 2's protection rules call it); it reads no file, no store and no box state, writes nothing outside the log sink, and makes no serving or root decision; the code is a reference for the owner, never an authorization; the class of Edge.observeAnalytics (J1 root-route) whole:Route@327 423c62d0adc16651bc65ff4ae2018b85274081c655275ac6e1f404a3ffa09ba9 |
| +internal/edge/reqrecords.go Edge.recordMatch legacy accepted-legacy accepted-legacy;rev3=census-ruling-edge-request-records;identity=the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=new: mints the block page's reference code with reqrec.NewRef from the time, the rule tier and id, this box's name and the current mesh key the edge already holds in memory (homes.meshKeys; nil when this box has none, giving an unsealed code), then, when a recorder is wired, files a Match built through requestResponse from the route passed in; its one scanned site is that route value; no production caller in Plan 1 (Plan 2's protection rules call it); it reads no file, no store and no box state, writes nothing outside the log sink, and makes no serving or root decision; the code is a reference for the owner, never an authorization; the class of Edge.observeAnalytics (J1 root-route) whole:Route@327 423c62d0adc16651bc65ff4ae2018b85274081c655275ac6e1f404a3ffa09ba9 |
| +# NEW, root-route: the Response for one request on one route, shared by observeRecords and recordMatch. Mirrors Edge.emitEdgeError and UsageMeter.Record (J1 root-route), which read the same route fields. |
| +@legacy 38926b3ab1e9b404d6535b98efcf10cb5f83733cd07ee8b1b53290aad679105b internal/edge/reqrecords.go requestResponse legacy accepted-legacy accepted-legacy;rev3=census-ruling-edge-request-records;identity=the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=new: a pure constructor: copies the account (release.RouteAccount of the route), app, host and environment of the route row the edge already resolved for this request, and the request's method, path, raw query, User-Agent, client address and GeoIP country (from the request context), with the status, into a reqrec.Response; the recorder masks the path, keeps only the query's names, and stores the client address only as its /24 (IPv6 /48) prefix and a day-salted hash before anything is stored; the account and app come from the route row, never the Host header; it reads no file, no store and no box state, writes nothing, and makes no decision; the class of Edge.emitEdgeError and UsageMeter.Record (J1 root-route) registry:App@192,registry:Environment@228,registry:Host@206,whole:Route@182 ce22da9cfa8c04c87b9c54fe3ab94dbdf77fb9162c82a01430686cfbdcf074fd |
| +internal/edge/reqrecords.go requestResponse legacy accepted-legacy accepted-legacy;rev3=census-ruling-edge-request-records;identity=the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=new: a pure constructor: copies the account (release.RouteAccount of the route), app, host and environment of the route row the edge already resolved for this request, and the request's method, path, raw query, User-Agent, client address and GeoIP country (from the request context), with the status, into a reqrec.Response; the recorder masks the path, keeps only the query's names, and stores the client address only as its /24 (IPv6 /48) prefix and a day-salted hash before anything is stored; the account and app come from the route row, never the Host header; it reads no file, no store and no box state, writes nothing, and makes no decision; the class of Edge.emitEdgeError and UsageMeter.Record (J1 root-route) registry:App@192,registry:Environment@228,registry:Host@206,whole:Route@182 ce22da9cfa8c04c87b9c54fe3ab94dbdf77fb9162c82a01430686cfbdcf074fd |
| +# NEW, crypto/rand: the reference code's nonce. Mirrors mintMeshKey (J4 root-input) and dbreads nonce (census-ruling-db-region-forward-1). |
| +@legacy 6b1e131bef42a514d4247a66c8d51b48dcc108bc1f605f922d6b71a27a78d798 internal/reqrec/ref.go NewRef legacy accepted-legacy accepted-legacy;rev3=census-ruling-edge-request-records;identity=the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=new: called only by Edge.recordMatch; one crypto/rand.Read of the code's 8-byte nonce from the kernel's random source (rand.Read, not a file), then an HMAC-SHA256 seal over the code's head with the mesh key the caller passed in, when it passed one; the nonce only makes codes unique, and the code is a reference the owner looks up, never an authorization; no file, no store, no box state, nothing written; the class of mintMeshKey's crypto/rand read (J4 root-input) and dbreads nonce (census-ruling-db-region-forward-1) file:Read@484 a2e27bb0dfd313172d0b43c81f9dceb91c13910c0258f027b720cd59593960c8 |
| +internal/reqrec/ref.go NewRef legacy accepted-legacy accepted-legacy;rev3=census-ruling-edge-request-records;identity=the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=new: called only by Edge.recordMatch; one crypto/rand.Read of the code's 8-byte nonce from the kernel's random source (rand.Read, not a file), then an HMAC-SHA256 seal over the code's head with the mesh key the caller passed in, when it passed one; the nonce only makes codes unique, and the code is a reference the owner looks up, never an authorization; no file, no store, no box state, nothing written; the class of mintMeshKey's crypto/rand read (J4 root-input) and dbreads nonce (census-ruling-db-region-forward-1) file:Read@484 a2e27bb0dfd313172d0b43c81f9dceb91c13910c0258f027b720cd59593960c8 |
diff --git a/internal/provision/testdata/plan14-root-reads-edge-request-records.tsv b/internal/provision/testdata/plan14-root-reads-edge-request-records.tsv| new file mode 100644 |
| index 000000000..141e3b57b |
| --- /dev/null |
| +++ b/internal/provision/testdata/plan14-root-reads-edge-request-records.tsv |
| @@ -0,0 +1,19 @@ |
| +# Census overlay edge-request-records, written by census-propose (#369). census-ruling-edge-request-records, approved by the census owner before the merge; the approval card is docs/superpowers/notes/census-proposal-edge-request-records.md. |
| +# 5 body, 1 sites, 6 envelope: each changed unit re-frozen at its existing disposition with its claim appended. |
| +@legacy deaa0aeb0e270dc8f9d2a8290344dd8ac6ddae3c87d522e1ee9f115cd003f05f internal/activator/activator.go Service.begin legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=Re-digested at the pre-land merge: the body includes main's own change under census ruling 292, with no further change from this branch. the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved;rev3=census-ruling-edge-request-records;basis=gains a req *http.Request parameter and one edge.MarkWoke(req) call on the path that starts a wake, so the edge's request record can say which request woke the app; no read added registry:Host@1721,registry:Host@1800,registry:Host@345,registry:Host@929,whole:Route@1730,whole:Route@1737 d970a98b11b0117f156f4e55686a03a4a086220ee5af58f9faabc237b1a76680 |
| +@legacy a5f2adf758e89146238046b72c4898dd2d4f8365c60b1a9d6792e4498ba20f25 internal/activator/activator.go Service.beginRequest legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=census-ruling-edge-request-records;basis=passes nil for begin's new req parameter; no read added whole:Route@122 7855ae6f1fcf183c898eb800b32d3e4eae02e6825358e5b0a5cc7071d2f8cc67 |
| +@legacy 94de995284365337144b9186f7c714ead6dcc7f494fbbab3f79cc9a6cc58c559 internal/activator/activator.go Service.serve legacy accepted-legacy accepted-legacy;rev3=census-ruling-hotfix281;basis=Startup repeats the existing Kind and Hibernate checks; error logging moved to serveWakeError. A request held through startup re-reads its own route's Socket and Addr and can only refuse (wake-timeout 503) when recovery moved them; agent-side, deny-only, no root decision.;rev3=census-ruling-edge-request-records;basis=passes the member request r to begin's new req parameter; no read added registry:Addr@952,registry:Addr@966,registry:Hibernate@1468,registry:Hibernate@151,registry:Host@1077,registry:Host@877,registry:Kind@126,registry:Kind@1442,registry:Socket@923,registry:Socket@939,whole:Route@1011,whole:Route@2587,whole:Route@347,whole:Route@3556,whole:Route@3619,whole:Route@902 b3e0ac74c186e9dae4c9883a53d2095bc68c9a79d60b732ddc96ab069db93fd8 |
| +@legacy 01294bd696b414cb2262eaa4bfc9e3005e728820c38bc6e71344686b5b62e0cd internal/activator/cmd.go Service.RunCmd legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): admits one run against an awake entry under the agent's own lease, fence and swap checks; it starts nothing itself and root validates what it later names;rev3=census-ruling-edge-request-records;basis=passes nil for begin's new req parameter; no read added file:Prepare@1675,file:Prepare@1709,registry:Host@1047,registry:Host@6681,registry:Kind@164,whole:Route@401,whole:Route@584,whole:Route@7281 21a595edf445e56ad24820bba3c801b970d27fb2022cc69fe04b67d15c1f51b9 |
| +@legacy 73d7c2b294e5d1ad459b34c0a882a277fb337571792b6ac468704e51abd09464 internal/edge/edge.go Edge.ServeHTTP legacy accepted-legacy accepted-legacy;rev3=census-ruling-seeded-instances;basis=the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with the import gate checked after the door's scope and a gated row left out of the response cache; serving only;rev3=census-ruling-edge-request-records;basis=one more call in the observer defer, observeRecords(up.route, ...), passing on the route the defer already holds; no new kind of read registry:Gate@13538,registry:Gate@13598,registry:Gate@13656,registry:Host@13641,registry:ImportGate@16713,registry:Kind@11721,registry:Kind@16684,whole:Route@11724,whole:Route@12282,whole:Route@12377,whole:Route@12453,whole:Route@12497,whole:Route@13541,whole:Route@13601,whole:Route@13644,whole:Route@13659,whole:Route@14472,whole:Route@16687,whole:Route@16716,whole:Route@17862,whole:Route@9739,whole:Route@9951 5bec3f736a64dba240f069c65f4f161a37d2104b53057712b19d0609cfe97110 |
| +internal/activator/activator.go Service.begin legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=Re-digested at the pre-land merge: the body includes main's own change under census ruling 292, with no further change from this branch. the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body; the stop now carries its reason for a run it interrupts (beginStopLocked's why argument); read sites unchanged, offsets moved;rev3=census-ruling-edge-request-records;basis=gains a req *http.Request parameter and one edge.MarkWoke(req) call on the path that starts a wake, so the edge's request record can say which request woke the app; no read added registry:Host@1721,registry:Host@1800,registry:Host@345,registry:Host@929,whole:Route@1730,whole:Route@1737 d970a98b11b0117f156f4e55686a03a4a086220ee5af58f9faabc237b1a76680 |
| +internal/activator/activator.go Service.beginRequest legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=census-ruling-edge-request-records;basis=passes nil for begin's new req parameter; no read added whole:Route@122 7855ae6f1fcf183c898eb800b32d3e4eae02e6825358e5b0a5cc7071d2f8cc67 |
| +internal/activator/activator.go Service.serve legacy accepted-legacy accepted-legacy;rev3=census-ruling-hotfix281;basis=Startup repeats the existing Kind and Hibernate checks; error logging moved to serveWakeError. A request held through startup re-reads its own route's Socket and Addr and can only refuse (wake-timeout 503) when recovery moved them; agent-side, deny-only, no root decision.;rev3=census-ruling-edge-request-records;basis=passes the member request r to begin's new req parameter; no read added registry:Addr@952,registry:Addr@966,registry:Hibernate@1468,registry:Hibernate@151,registry:Host@1077,registry:Host@877,registry:Kind@126,registry:Kind@1442,registry:Socket@923,registry:Socket@939,whole:Route@1011,whole:Route@2587,whole:Route@347,whole:Route@3556,whole:Route@3619,whole:Route@902 b3e0ac74c186e9dae4c9883a53d2095bc68c9a79d60b732ddc96ab069db93fd8 |
| +internal/activator/cmd.go Service.RunCmd legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): admits one run against an awake entry under the agent's own lease, fence and swap checks; it starts nothing itself and root validates what it later names;rev3=census-ruling-edge-request-records;basis=passes nil for begin's new req parameter; no read added file:Prepare@1675,file:Prepare@1709,registry:Host@1047,registry:Host@6681,registry:Kind@164,whole:Route@401,whole:Route@584,whole:Route@7281 21a595edf445e56ad24820bba3c801b970d27fb2022cc69fe04b67d15c1f51b9 |
| +internal/host/agent.go runAgent authority B,C,D,F rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with wireSeedPlacement called in the activator start's Configure step, before armMovesPass, and the startup sweep's result stored for the import rollback in Recover; read sites unchanged, offsets moved; main's B,C,D,F authority retained PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.;rev3=PROPOSED-325;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=passes the agent's log sink to armRunsPass; reads unchanged;rev3=census-ruling-db-region-forward-1;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=arms the db-reads loop (armDBReads) beside armRunsPass in the activator start's Configure step; reads unchanged, offsets moved; main's authority retained;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=arms the change index (armChangeIndex) and starts the record view's backstop loop before the loops that read through it, and hands the edge the watch loader (edge.WithChangeWatch); read sites unchanged at the same offsets;rev3=census-ruling-edge-request-records;basis=builds the edge request recorder against the existing log sink and data dir (newRequestRecorder, passed os.Getenv and time.Now) and starts reqrecLoop on a minute ticker; no read added file:Exec@13802,file:Open@731,registry:App@10065,whole:Route@10057,whole:Route@23518 c6ab3cb9b690537e6f9e179ddf09d869c5e691af0d02cb901ef57b3bb5db4f69 |
| +internal/edge/edge.go Edge.ServeHTTP legacy accepted-legacy accepted-legacy;rev3=census-ruling-seeded-instances;basis=the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with the import gate checked after the door's scope and a gated row left out of the response cache; serving only;rev3=census-ruling-edge-request-records;basis=one more call in the observer defer, observeRecords(up.route, ...), passing on the route the defer already holds; no new kind of read registry:Gate@13538,registry:Gate@13598,registry:Gate@13656,registry:Host@13641,registry:ImportGate@16713,registry:Kind@11721,registry:Kind@16684,whole:Route@11724,whole:Route@12282,whole:Route@12377,whole:Route@12453,whole:Route@12497,whole:Route@13541,whole:Route@13601,whole:Route@13644,whole:Route@13659,whole:Route@14472,whole:Route@16687,whole:Route@16716,whole:Route@17862,whole:Route@9739,whole:Route@9951 5bec3f736a64dba240f069c65f4f161a37d2104b53057712b19d0609cfe97110 |
| +@coverage internal/activator 9fc49ac93dbfd3a28a9138ed419cbdb1b32b4ea4613fc0666c71631afdb90a64 |
| +@coverage internal/applog 0b27840a118550198c29eec29dbc76e07f82554bcb22f1548eb9f5f28b97b1a0 |
| +@coverage internal/console 245bace42144c1f67a212b4901ae9223f46feddaae65e4c79efd0091cdfd6ee5 |
| +@coverage internal/edge 6dbf833d9e7f0800f15c6115dfa074856e99261df3b84fae721880ae3d45333e |
| +@coverage internal/host 21d3020208aa1de73578cb5a038af4116136b811f276446c2a5269de1b92aa37 |
| +@coverage internal/reqrec 2c495a761af6d1053683a14bf90dd3b56aaa37330d96b98686bc6f23d70ee149 |