carlos / platform Public

docs: a scoped key constrains the direct path; memberships constrain the API path

Merge-resolution review F1/F5: record the mode-authority split in the
scoped-keys spec and README so nobody believes a canary-only builder key
limits what a console credential can promote.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Paul Campbell 2 months ago a1bd7c6d398a6be091b3806a15726314edd133d3 parent fa41fc9

2 files changed, +11 −1

README.md +3 −1
docs/superpowers/specs/2026-08-03-scoped-signing-keys-design.md +8 −0

diff --git a/README.md b/README.md

index 51136f1cc..e1aae8928 100644

--- a/README.md

+++ b/README.md

@@ -126,7 +126,9 @@ refusal prints.

CI and operators keep the existing path unchanged: set

`CARLOS_DEPLOYMENT_BUCKET` (or `_DIR`) and every verb goes straight at the

bucket, exactly as before — logging in is for a human at a laptop, never a box

-or a pipeline.

+or a pipeline. Note the modes carry different authority: a scoped

+`CARLOS_RELEASE_KEY` constrains the direct path only — in API mode it is

+ignored and your console membership (plus the rung gates) is what decides.

**On a box, or in CI, don't log in.** There is no browser and no human, and a

long-lived token sitting on a box is a standing credential nobody is watching.

diff --git a/docs/superpowers/specs/2026-08-03-scoped-signing-keys-design.md b/docs/superpowers/specs/2026-08-03-scoped-signing-keys-design.md

index 4b50a3dc9..8f45cbdf7 100644

--- a/docs/superpowers/specs/2026-08-03-scoped-signing-keys-design.md

+++ b/docs/superpowers/specs/2026-08-03-scoped-signing-keys-design.md

@@ -107,6 +107,14 @@ holds. If that is a scoped seed, the accompanying `CARLOS_RELEASE_GRANT`

outside the grant fails LOCALLY with a clear error before any write —

matching the ladder's refusal style.

+That sentence is DIRECT-mode truth only. In the CLI's API mode (a stored

+`carlos auth login` credential and no store env — see the cli-console-api

+spec §1) a `CARLOS_RELEASE_KEY` in the environment is INERT: the console

+signs with the deployment's root key and authority is membership + the rung

+gate, so a "canary-only" scoped key on a laptop does not constrain what

+that laptop's console credential can promote. Scoped keys constrain the

+direct path; memberships constrain the API path.

## 5. Verification surface

One function change: `verifyPointer` grows grant handling. Its callers —