amadan
The handoff records cd8821c6 as the last product-code commit with its gate, CI and review state, and the activator test fix on top
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2 files changed,
+15
−16
.claude/HANDOFF.md+14 −15implementation/carloku-paid-launch/OUTSTANDING.md+1 −1
CI passed — run details
diff --git a/.claude/HANDOFF.md b/.claude/HANDOFF.md| index 3e118c008..d7781f9f1 100644 |
| --- a/.claude/HANDOFF.md |
| +++ b/.claude/HANDOFF.md |
| @@ -7,33 +7,31 @@ |
| Get Carloku's paid plans live with Stripe Tax and the complete metered model; have the pricing page and signup flow reviewable in the morning. |
| **STATUS:** |
| -Written 09:10 Dublin on 2026-10-01. Three things, kept apart. |
| +Written 09:40 Dublin on 2026-10-01. Three things, kept apart. |
| 1. Draft copy to review, not approved: pricing http://100.119.180.57:38009 (name form http://docs-t1.tail5fd3ba.ts.net:38009), console billing page http://100.119.180.57:45033 (name form http://docs-t1.tail5fd3ba.ts.net:45033). |
| 2. A demo to click through: http://100.119.180.57:41881, real console handlers with Keymail and Stripe simulated. It is not Stripe proof. |
| 3. A tested branch that is not production-ready. `implementation/carloku-paid-launch/OUTSTANDING.md` says what is reviewable, tested and proven, lists every launch blocker, and lists each approval to ask for with its exact scope. |
| -All three review servers answered 200 on the IP form at 09:03 Dublin. |
| +All three review servers answered 200 on the IP form at 09:31 Dublin. |
| -Preview readiness with billing off is not launch readiness. Full metering is not ready: neither metered source is proven (replication writes, store transfer), Stripe has no catalog or runtime key and the quantity fence is unverified, and quantity reduction at renewal and the Free tier are not built. |
| +Preview readiness with billing off is not launch readiness, and a review that accepts a diff is not approval of the branch. Full metering is not ready: neither metered source is proven (replication writes, store transfer), Stripe has no catalog or runtime key and the quantity fence is unverified, and quantity reduction at renewal and the Free tier are not built. |
| Billing is OFF, the quantity worker is OFF (two switches, both unset), nothing attests, nothing was deployed, and no live Stripe or AWS write was made. |
| -Code tip when this was written: `abc9f781`. This file does not claim what later commits contain; read `git log abc9f781..` for that. On `abc9f781`: |
| +Tip when this was written: `bac513f6`. This file does not claim what later commits contain; read `git log bac513f6..` for that. |
| -- Local gate: go build, go vet, gofmt, `make test` with 61 packages ok (`logs/gate-abc9f781.txt` in the run directory); cross builds for darwin, linux arm64 and windows (`logs/cross-abc9f781.txt`). |
| -- Amadan CI: running when this was written. `run.json` in the run directory, or `amadan ci status carlos/platform -branch feat/carloku-paid-launch-20260916`, has the result. CI sat queued all night, first ran at 07:34 Dublin, and has passed on `1395f7bf`, `d0a21aa1`, `d5705a63` and `973a9f15`. The local gate is not offered in CI's place. |
| -- Review: not confirmed. Round sixteen of both reviewers was started against `abc9f781` at 09:04 (run directory `logs/astra-review16.md`, `logs/opus-review16.md`). |
| +- `cd8821c6` is the last commit that changes product code (round seventeen's fixes). Local gate on it: build, vet, gofmt, `make test` with 61 packages ok on the second run (`logs/gate-cd8821c6.txt` in the run directory; the first run failed one `internal/activator` test, log kept as `logs/gate-cd8821c6-run1-failed.txt`); cross builds for darwin, linux arm64 and windows (`logs/cross-cd8821c6.txt`). Amadan CI passed on `cd8821c6`. |
| +- `bac513f6` changes one test file only: it fixes that activator test. Its recording script wrote a file with a shell redirect, which creates the file empty before the content arrives, and the test could read it in that moment. The file is now renamed into place whole. Under the same load, 55 failures in 1,280 runs before and none after. Local gate on `bac513f6`: 61 packages ok, first run (`logs/gate-bac513f6.txt`). CI had not run on it when this was written. |
| +- Amadan CI sat queued all night, first ran at 07:34 Dublin, and has passed on `1395f7bf`, `d0a21aa1`, `d5705a63`, `973a9f15`, `abc9f781`, `86a1849d` and `cd8821c6`. The local gate is not offered in CI's place. |
| -Earlier gated tips: `973a9f15`, `d5705a63`, `d0a21aa1`, `1395f7bf`, `84311b9f`, `94ca7482`, `3d4104cb`, `c3e87a94`, `43383b93`. On `1395f7bf` the gate's first run failed one test in `internal/activator`, a package that commit does not touch (`TestExecBackendStartWorkerEnvWinsOverTenantFile`, which reads a file a child process is still writing); it passed 30 runs alone and the second full run passed; both logs are kept. |
| - |
| -Independent review: no round has passed. GPT-6 Astra rejected rounds 1 to 15; the AGENTS-required Opus production review accepted with fixes in rounds 2 to 15. Each round found the round before closed for its reported shapes and found neighbouring ones, in the object-store walks (`internal/objstore`) since round seven. Round fifteen's findings (Astra one P1, one P2; Opus one P2, two P3) are fixed in `abc9f781` with reproductions and mutation checks, except what `OUTSTANDING.md` names as open (19a to 19h). Nothing lands until a round passes. Dispositions, round by round: `docs/superpowers/specs/CODEX-DISPOSITIONS-carloku-paid-launch-overnight.md`. |
| +Independent review. No review of the whole branch has passed. GPT-6 Astra rejected rounds 1 to 16; the AGENTS-required Opus production review accepted with fixes in rounds 2 to 16. Each round found the round before closed for its reported shapes and found neighbouring ones, in the object-store walks (`internal/objstore`) and their readers since round seven. Round seventeen read only the diff since round sixteen: Opus accepted, Astra accepted with fixes (one P2). That P2 and Opus's small items are fixed in `cd8821c6` and have not been read by a reviewer. Open items the reviews left are in `OUTSTANDING.md` 19a to 19i. Nothing lands until the whole branch has been read and accepted. Dispositions, round by round: `docs/superpowers/specs/CODEX-DISPOSITIONS-carloku-paid-launch-overnight.md`. |
| Two open defects, both with their paths disabled, neither offered as a risk to accept: a quantity request that runs after Stripe has forgotten its key, and a late invoice-line request that can leave a finalized invoice with a wrong total a customer could pay. The design that removes both is `docs/superpowers/plans/2026-10-01-late-request-fencing.md`. |
| Side branches, all on the forge, each with the full local gate passing on the named tip (base `d5705a63`), none reviewed, none run through CI, nothing on the launch branch calls them: |
| -- `feat/carloku-late-request-fencing-20261001` (`1772e840`): a Stripe request cannot outlive its connection. It also voids a wrong-total invoice; that is remediation, and its limits are pinned by tests there. The gate caught, and a commit fixed, a timeout the new transport reported as a network fault. |
| +- `feat/carloku-late-request-fencing-20261001` (`1772e840`): a Stripe request cannot outlive its connection. A first review by both reviewers was started at 09:35 (run directory `logs/astra-fencing-review1.md`, `logs/opus-fencing-review1.md`). It also voids a wrong-total invoice; that is remediation, and its limits are pinned by tests there. The gate caught, and a commit fixed, a timeout the new transport reported as a network fault. |
| - `feat/carloku-metered-replicator-20261001` (`ebab1a37`): path B, first build. A metered replication store with no unmetered fallback, an owner for every database the box replicates, a fleet store that refuses anything it cannot meter. Nothing attests. Code map: run directory `notes/path-b-replicator-code-map.md`. |
| - `feat/carloku-bucket-hour-evidence-20261001` (`58c1870c`): the operator evidence door for a store's partial first hour. The hour still holds by default; the door releases only that hour, only for the owner the ledger names, on a named person's recorded evidence. |
| - `feat/carloku-scoped-attestation-20261001` (`058ea506`): path A, parked. It cannot prove an exclusive writer. Replication-write completeness is a launch blocker, not waived. |
| @@ -43,9 +41,10 @@ Side branches, all on the forge, each with the full local gate passing on the na |
| - Scoped approvals, prepared as plans only: Stripe test mode, to run `TestSandboxQuantityFence`; the `rk_live` restricted key and Stripe catalog; the Cost and Usage Report export; one scratch-object write to check S3's conditional delete. Exact scopes are in the approvals table of `OUTSTANDING.md`. |
| **RECOMMENDED:** |
| -- Read round sixteen and the CI result on `abc9f781`. Fix what round sixteen finds, gate, and re-review the exact tip. |
| -- Review the three gated side branches, starting with late-request fencing. |
| -- Then, each on its own branch: the agent wiring and restore path for path B, the evidence door for a box's first minutes, quantity reduction at renewal, the AWS principal inventory and the bucket ownership attestation door, Free-tier enforcement, dormancy and pool accounting. |
| +- Read the fencing branch's first review and fix what it finds on that branch. |
| +- Have the whole launch branch read again at its tip, not a diff, before anything is called accepted. |
| +- Review the other two gated side branches (metered replicator, bucket-hour evidence). |
| +- Then, each on its own branch: the agent wiring and restore path for path B, the evidence door for a box's first minutes, quantity reduction at renewal, the storage pass using the holder inventory (19i), the AWS principal inventory and the bucket ownership attestation door, Free-tier enforcement, dormancy and pool accounting. |
| **SESSION:** |
| -Not safe to close without a look: three review servers are serving on this box (pids and stop file under `/home/paulca/.local/share/carloku-paid-launch-20260930/logs`), and two review processes may still be running. Scratch left on the box: `~/.cache/tmp/claude-1001/{mutcopy,fencing-wt,replicator-wt,evidence-wt}` (the last three are git worktrees), `/tmp/k`, `~/.cache/carloku-gate`. |
| +A bounded heartbeat (`carloku-paid-launch-continuity`, id `a1f7c9af`, every 30 minutes, six runs at most, three hours) returns to this same agent from 10:00 Dublin. Not safe to close without a look: three review servers are serving on this box (pids and stop file under `/home/paulca/.local/share/carloku-paid-launch-20260930/logs`), and two review processes may still be running. Scratch left on the box: `~/.cache/tmp/claude-1001/{mutcopy,fencing-wt,replicator-wt,evidence-wt}` (the last three are git worktrees), `/tmp/k`, `~/.cache/carloku-gate`. |
diff --git a/implementation/carloku-paid-launch/OUTSTANDING.md b/implementation/carloku-paid-launch/OUTSTANDING.md| index 94c146eaa..a67c7d412 100644 |
| --- a/implementation/carloku-paid-launch/OUTSTANDING.md |
| +++ b/implementation/carloku-paid-launch/OUTSTANDING.md |
| @@ -73,7 +73,7 @@ Each is concrete. None is waived. |
| 19c. **S3's conditional delete is unverified on a real backend.** The store walks and the app purge delete a record only as the generation they read. That has run against the directory store and an HTTP stub. No `If-Match` delete has been sent to AWS or to an S3-compatible store, and a backend that ignored the header would delete unconditionally. It needs one write to a scratch object, which is a production-adjacent write nobody has approved. |
| 19d. **The signing-time fence has been observed on AWS only.** An S3-compatible deployment or store endpoint has not been probed for its window. |
| 19a. **A retained teardown finishes only when someone runs it again.** Nothing runs it. A store that left a bucket to another account keeps its record until then. Until then its scanning shows no coverage and its storage is held each day, for its own account only, not measured: the bucket's bytes are the other account's. A day written as held stays held for that account; there is no rebuild door (item 18). |
| -20. **Amadan CI has passed on `1395f7bf`, `d0a21aa1`, `d5705a63` and `973a9f15`.** It sat queued on every tip all night and first ran at 07:34 Dublin on 2026-10-01. Any later code tip needs its own run; the local gate (build, vet, gofmt, `make test`, cross builds) is not CI and is not offered in its place. An agent account can neither see nor manage the runners. The hub's `carlos/platform` repository also answered 500 on and off through the night; bundles of every tip are in the run directory. |
| +20. **Amadan CI has passed on `1395f7bf`, `d0a21aa1`, `d5705a63`, `973a9f15`, `abc9f781`, `86a1849d` and `cd8821c6`.** It sat queued on every tip all night and first ran at 07:34 Dublin on 2026-10-01. Any later code tip needs its own run; the local gate (build, vet, gofmt, `make test`, cross builds) is not CI and is not offered in its place. An agent account can neither see nor manage the runners. The hub's `carlos/platform` repository also answered 500 on and off through the night; bundles of every tip are in the run directory. |
| 21. **A scanner backend that calls a provider must be fenced like the walks.** Today's scanner (ClamAV) makes no provider call at teardown. A native one would, and its client would need the fenced signer. |
| ## Approvals to ask for, each with its exact scope |