amadan
fix wave 1: roll notes, audit of every data-dir copy and restore path for the failure book
No path in this repo or platform-infrastructure carries /data/swap-failures.json; the repos not checked out here are named.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+25
−2
docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md+25 −2
diff --git a/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md b/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md| index 31cd1147f..f8eadabc0 100644 |
| --- a/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md |
| +++ b/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md |
| @@ -383,8 +383,31 @@ by 076bd9c0 (final review round 1), pending merge. |
| clones, restores or relocates an agent data dir (a rebuilt box from an |
| image or snapshot, a hand copy) must delete the `book` key from |
| `swap-failures.json` in the copy. The next open then makes a new identity. |
| - This is unaudited: nothing yet checks the fleet's rebuild and restore paths |
| - for it. |
| + |
| + Audit (fix wave 1, item 7, at `929dfc39`). The book is |
| + `/data/swap-failures.json` (`CARLOS_DATA_DIR`, default `/data`). Every |
| + path found in this repo and in `platform-infrastructure` (at `841e94b`) |
| + that copies, snapshots, restores, rsyncs or images agent data: |
| + |
| + | Path | What it carries | Can the book travel? | |
| + |---|---|---| |
| + | Box rebuild or replace (`infra/modules/region-host`, `tofu apply -replace`) | Stock Debian AMI (`data.aws_ami`); root volume `delete_on_termination = true`; no other volume | No. The new box's `/data` is empty, and the first open makes a new identity. | |
| + | Cold-standby box (`platform-infrastructure/dev/standby-ie.tf`) | A fresh box that converges from the bucket like any new box | No. Same as a rebuild. | |
| + | Box init (`host-init.sh`, `host-init.sh.tftpl`, `scripts/bootstrap-box.sh`) | Creates `/data` and fetches the binary | No. Nothing is copied into `/data`. | |
| + | Instance move (`internal/host/movespass.go` `FilesDir`, `internal/moves/archive`) | `/data/<host>/` and `/data/<host>.env` only | No. The book is at the `/data` root and is not in the archive. | |
| + | Litestream replication and `carlos ops restore-verify` | `*.db` files | No. The book is JSON, not a database. | |
| + | Hibernate wake restore (`Restore`, `internal/lease`), claims cold restore (`internal/hostbox` `ColdRestore`) | One instance's database | No. | |
| + | Layout migration (`internal/layout`) | Instance directories inside one box's `/data` | No. Same box, same file. | |
| + | Box volume records (`internal/boxvolumes`) | Records of EBS mappings; nothing is reattached | No. A terminated box leaves no disk (region HA spec 1 §5.9). | |
| + | Platform update (`scripts/update-platform-binary.sh`, `carlos system update`, `carlos-system-recover.service`) | `/opt/carlos` binaries | No. | |
| + |
| + No path carries the book, so no code change was needed. Not audited, and |
| + outside these two repos: `carlosframework/carloku-infrastructure` (the |
| + flagship root since 2026-10-01) and `teamtito/carlos-infrastructure` |
| + (`RUNBOOK-edge-failover.md`), which have no local checkout here; AWS |
| + Backup or DLM policies made outside tofu (none appear in either repo); |
| + and any copy made by hand. Each of those must drop the `book` key as |
| + above before the flag goes on. |
| - **An armed box without `CLONE_INTO_CGROUP` refuses every generation |
| start** (`98593909`, `8530210e`). A generation start must be placed in its |
| cgroup before exec. If clone3 placement is unavailable (the fallback has |