amadan
The handoff names d0a21aa1 as the code tip with its gate and CI result; round thirteen is running
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2 files changed,
+9
−7
.claude/HANDOFF.md+7 −5implementation/carloku-paid-launch/OUTSTANDING.md+2 −2
CI passed — run details
diff --git a/.claude/HANDOFF.md b/.claude/HANDOFF.md| index ba65183cc..1352afc6c 100644 |
| --- a/.claude/HANDOFF.md |
| +++ b/.claude/HANDOFF.md |
| @@ -7,26 +7,28 @@ |
| Get Carloku's paid plans live with Stripe Tax and the complete metered model; have the pricing page and signup flow reviewable in the morning. |
| **STATUS:** |
| -Three things, kept apart. (1) Draft copy to review, not approved: pricing http://docs-t1.tail5fd3ba.ts.net:38009 (fallback http://100.119.180.57:38009), console billing page http://docs-t1.tail5fd3ba.ts.net:45033 (fallback http://100.119.180.57:45033). (2) A demo to click through: http://100.119.180.57:41881, real console handlers with Keymail and Stripe simulated; not Stripe proof. (3) A tested branch that is not production-ready: `implementation/carloku-paid-launch/OUTSTANDING.md` says what is reviewable, tested and proven, lists every launch blocker, and lists each approval to ask for with its exact scope. All three review servers answered 200 on the IP form at 07:33 Dublin on 2026-10-01. |
| +Three things, kept apart. (1) Draft copy to review, not approved: pricing http://docs-t1.tail5fd3ba.ts.net:38009 (fallback http://100.119.180.57:38009), console billing page http://docs-t1.tail5fd3ba.ts.net:45033 (fallback http://100.119.180.57:45033). (2) A demo to click through: http://100.119.180.57:41881, real console handlers with Keymail and Stripe simulated; not Stripe proof. (3) A tested branch that is not production-ready: `implementation/carloku-paid-launch/OUTSTANDING.md` says what is reviewable, tested and proven, lists every launch blocker, and lists each approval to ask for with its exact scope. All three review servers answered 200 on the IP form at 07:55 Dublin on 2026-10-01. |
| Billing is OFF, the quantity worker is OFF (two switches, both unset), nothing attests, nothing was deployed, and no live Stripe or AWS write was made. |
| -Code tip `1395f7bf` (it changes code: round eleven's fixes, in `internal/objstore`). Full gate on that exact commit: go build, go vet, gofmt, `make test` with 61 packages ok (`logs/gate-1395f7bf.txt` in the run directory); cross builds for darwin, linux arm64 and windows (`logs/cross-1395f7bf.txt`). The gate's first run on this commit failed one test in `internal/activator`, a package the commit does not touch (`TestExecBackendStartWorkerEnvWinsOverTenantFile`, which reads a file a child process is still writing); it passed 30 runs alone and the second full run passed. The failed log is kept as `logs/gate-1395f7bf-run1-failed.txt`. Commits after `1395f7bf` on this branch are documents only unless this file says otherwise; the earlier gated tips were `84311b9f`, `94ca7482`, `3d4104cb`, `c3e87a94` and `43383b93`. Amadan CI sat queued on every tip all night, first ran at 07:34 Dublin on `1395f7bf`, and passed on that commit. Later tips need their own run. |
| +Code tip `d0a21aa1` (it changes code: round twelve's fixes, in `internal/objstore`, `internal/console/apiscan.go` and `internal/release/trash.go`). Full gate on that exact commit: go build, go vet, gofmt, `make test` with 61 packages ok (`logs/gate-d0a21aa1.txt` in the run directory); cross builds for darwin, linux arm64 and windows (`logs/cross-d0a21aa1.txt`). Commits after `d0a21aa1` on this branch are documents only unless this file says otherwise; the earlier gated tips were `1395f7bf`, `84311b9f`, `94ca7482`, `3d4104cb`, `c3e87a94` and `43383b93`. On `1395f7bf` the gate's first run failed one test in `internal/activator`, a package that commit does not touch (`TestExecBackendStartWorkerEnvWinsOverTenantFile`, which reads a file a child process is still writing); it passed 30 runs alone and the second full run passed; both logs are kept. |
| -Independent review: no round has passed. GPT-6 Astra rejected rounds 1 to 12; the AGENTS-required Opus production review accepted with fixes in rounds 2 to 12. Round twelve read `1395f7bf`: every round-eleven finding is closed for its reported shape; Astra found one P1 and two P2, Opus one P2 and three P3, all in the store walks and none fixed in `1395f7bf` (run directory `logs/astra-review12.md`, `logs/opus-review12.md`; copies under `docs/superpowers/specs`). Nothing lands until a round passes. Dispositions: `docs/superpowers/specs/CODEX-DISPOSITIONS-carloku-paid-launch-overnight.md`. |
| +Amadan CI sat queued on every tip all night. It first ran at 07:34 Dublin on 2026-10-01 and has passed on `1395f7bf` and on `d0a21aa1`. Later code tips need their own run; the local gate is not offered in CI's place. |
| + |
| +Independent review: no round has passed. GPT-6 Astra rejected rounds 1 to 12; the AGENTS-required Opus production review accepted with fixes in rounds 2 to 12. Round twelve (Astra one P1, two P2; Opus one P2, three P3) is fixed in `d0a21aa1` with reproductions and mutation checks, except what `OUTSTANDING.md` names as open (19g). Those fixes have had no independent confirmation: round thirteen of both runs against `d0a21aa1`, run directory `logs/astra-review13.md` and `logs/opus-review13.md`. Nothing lands until a round passes. Dispositions: `docs/superpowers/specs/CODEX-DISPOSITIONS-carloku-paid-launch-overnight.md`. |
| Two open defects, both with their paths disabled, neither offered as a risk to accept: a quantity request that runs after Stripe has forgotten its key, and a late invoice-line request that can leave a finalized invoice with a wrong total a customer could pay. The design that removes both is `docs/superpowers/plans/2026-10-01-late-request-fencing.md`, built so far on `feat/carloku-late-request-fencing-20261001` (`68f77faf`, pushed, not gated, not reviewed). That branch also voids a wrong-total invoice; that is remediation, and its limits are pinned by tests there. |
| Scoped replication attestation (path A) cannot prove an exclusive writer and is off this branch, parked on `feat/carloku-scoped-attestation-20261001` (pushed). Replication-write completeness is a launch blocker, not waived. Path B has a first build on `feat/carloku-metered-replicator-20261001` (`2140eb7b`, pushed, not gated, not reviewed): a metered replication store with no unmetered fallback, an owner for every database the box replicates, and a fleet store that refuses anything it cannot meter. Nothing calls it and nothing attests. Its code map is in the run directory, `notes/path-b-replicator-code-map.md`. |
| -The operator evidence door for a store's partial first hour has a first build on `feat/carloku-bucket-hour-evidence-20261001` (`0a578f22`, not gated, not reviewed). The hour still holds by default; the door releases only that hour, only for the owner the ledger names, on a named person's recorded evidence. |
| +The operator evidence door for a store's partial first hour has a first build on `feat/carloku-bucket-hour-evidence-20261001` (`457c8da3`, rebased on `d0a21aa1`; the full local gate passes on it, `logs/gate-evidence-457c8da3.txt`; not reviewed, no CI run). The hour still holds by default; the door releases only that hour, only for the owner the ledger names, on a named person's recorded evidence. |
| **NEEDED:** |
| - Paul: approve or edit both copy reviews; confirm the HALF code word; decide the proration policy; approve or change the whole-paid-day rule for partial months; review member copy for the store refusals. No ruling is asked for on a store's first clock hour or a box's first minutes: they hold by default, and what releases one is an operator evidence door (not built), not a waiver. |
| - Scoped approvals, prepared as plans only: the `rk_live` restricted key and Stripe catalog; the Cost and Usage Report export; Stripe test mode, to run `TestSandboxQuantityFence` and confirm the provider's treatment of a proration date. |
| **RECOMMENDED:** |
| -- Fix round twelve's findings, gate and re-review the exact tip, and get CI on it. |
| +- Read round thirteen and the CI result on `d0a21aa1`; fix what they find and re-review the exact tip. |
| - Finish the late-request design on its branch (the invoice engine's void on a failed verification, the idle measurement in the sandbox test), then review it. |
| - Then, each on its own branch: path B of the attestation plan, quantity reduction at renewal, the AWS principal inventory and the bucket ownership attestation door, Free-tier enforcement, dormancy and pool accounting (none started). |
| - Find what moved 1,395 GB out of Ireland to three other regions in September (collector plan). |
diff --git a/implementation/carloku-paid-launch/OUTSTANDING.md b/implementation/carloku-paid-launch/OUTSTANDING.md| index efe6a7bc5..8d95f7f6f 100644 |
| --- a/implementation/carloku-paid-launch/OUTSTANDING.md |
| +++ b/implementation/carloku-paid-launch/OUTSTANDING.md |
| @@ -34,7 +34,7 @@ Each is concrete. None is waived. |
| 1. **Replication writes (`durability_writes_1k`) cannot be proven on any box.** The external replicator writes outside the ledger. Path A (scoped attestation) was built, reviewed in round six, and cannot prove an exclusive writer; it is off this branch and parked on `feat/carloku-scoped-attestation-20261001`. Path B (the platform's own replicator as the only writer) is **partial, unwired**, on `feat/carloku-metered-replicator-20261001` (`2140eb7b`, on the forge): a litestream store whose every replica client is metered with no unmetered fallback, an owner for each database the box replicates, and a fleet store that refuses anything it cannot meter, each with tests. **Absent**: the agent wiring that binds those meters to the box's ledger, a restore path that does not shell out to the external binary, the unit change, moving the replica credentials so nothing else on the box holds them (the unit runs as the same user as the agent today), and any attestation. Until all of that exists and is approved for a box, this meter is incomplete every month and nothing is invoiced. |
| 2. **Store transfer (`store_egress_gb`) has no source.** No Cost and Usage Report export exists on the account. It needs the scoped infrastructure approval, a first real delivery, an IAM principal inventory in the AWS provisioner (not built), and the bucket ownership attestation for stores that already exist (designed, not built). |
| -3. **A store's partial first hour** with a charged line holds the month, and nothing releases it. It holds by default and nobody is asked to waive it. What can release it is evidence: an operator door that records, for one bucket-hour, who is shown to have owned it and on what evidence, which the fold then honours. **Partial, unwired into this branch**, on `feat/carloku-bucket-hour-evidence-20261001` (`0a578f22`): the record, the fold change and three operator API doors, with tests and mutation checks. It accepts only the hour a complete ledger began vouching in and only the owner that ledger names. Not gated, not reviewed, no CLI verb, and its operator-facing sentences are unreviewed. |
| +3. **A store's partial first hour** with a charged line holds the month, and nothing releases it. It holds by default and nobody is asked to waive it. What can release it is evidence: an operator door that records, for one bucket-hour, who is shown to have owned it and on what evidence, which the fold then honours. **Partial, unwired into this branch**, on `feat/carloku-bucket-hour-evidence-20261001` (`457c8da3`): the record, the fold change and three operator API doors, with tests and mutation checks. It accepts only the hour a complete ledger began vouching in and only the owner that ledger names. The full local gate passes on it. Not reviewed, no CI run, no CLI verb, and its operator-facing sentences are unreviewed. |
| 4. **A box's first minutes** before its ledger opened hold that day for everyone. Same as item 3: it holds by default, and the release is an operator evidence door, not a waiver. **Absent**. |
| ### Stripe |
| @@ -71,7 +71,7 @@ Each is concrete. None is waived. |
| 19c. **S3's conditional delete is unverified on a real backend.** The store walks and the app purge delete a record only as the generation they read. That has run against the directory store and an HTTP stub. No `If-Match` delete has been sent to AWS or to an S3-compatible store, and a backend that ignored the header would delete unconditionally. It needs one write to a scratch object, which is a production-adjacent write nobody has approved. |
| 19d. **The signing-time fence has been observed on AWS only.** An S3-compatible deployment or store endpoint has not been probed for its window. |
| 19a. **A retained teardown finishes only when someone runs it again.** Nothing runs it. A store that left a bucket to another account keeps its record until then. |
| -20. **Amadan CI has run once, on `1395f7bf`, and passed.** It sat queued on every tip all night and first ran at 07:34 Dublin on 2026-10-01. Any later tip needs its own run; the local gate (build, vet, gofmt, `make test`, cross builds) is not CI and is not offered in its place. An agent account can neither see nor manage the runners. The hub's `carlos/platform` repository also answered 500 on and off through the night; bundles of every tip are in the run directory. |
| +20. **Amadan CI has passed on `1395f7bf` and on `d0a21aa1`.** It sat queued on every tip all night and first ran at 07:34 Dublin on 2026-10-01. Any later code tip needs its own run; the local gate (build, vet, gofmt, `make test`, cross builds) is not CI and is not offered in its place. An agent account can neither see nor manage the runners. The hub's `carlos/platform` repository also answered 500 on and off through the night; bundles of every tip are in the run directory. |
| 21. **A scanner backend that calls a provider must be fenced like the walks.** Today's scanner (ClamAV) makes no provider call at teardown. A native one would, and its client would need the fenced signer. |
| ## Approvals to ask for, each with its exact scope |