carlos / platform Public

docs: the stripped console build line Paul approved for carlos system claims

Paul approved all eight claim-step6-artifacts strings verbatim (copy review
result /home/paulca/.cache/claim-step6-copy/result.json). Seven were already
in the code and cli.md byte for byte; this adds the eighth,
docs.claims.console_stripped, as its own paragraph right after the
install-console paragraph. Nothing else changes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 6 days ago b01ea83d807527d63dd73ea73585f8955dce5091 parent a892bd5

1 file changed, +2 −0

docs/site/cli.md +2 −0

diff --git a/docs/site/cli.md b/docs/site/cli.md

index 1f1a7ea37..acb932b96 100644

--- a/docs/site/cli.md

+++ b/docs/site/cli.md

@@ -2162,6 +2162,8 @@ Two `run` phases make the files `carlos system guard-arm` takes. `sign-policy` s

`install-console` copies the console build that the published identity names into `/opt/carlos/system/console/console` and `console.prev`, owned by root. It refuses a source whose bytes don't match the identity, and it doesn't touch `console.service`. Pass that path to `guard-arm --console`.

+Build it stripped, with -s -w, as releases are built.

After starting the guarded console, run `console-report` on its box as root. It checks the signed roster, guard, systemd process and running executable, then records that process in the existing private box report. It refuses stale box evidence and leaves the report’s timestamp unchanged. Run it again after a console restart and immediately before floor publication; the next agent report may replace the process entry.

#### carlos system journal-migrate