carlos / platform Public

docs: cohort-1 step 5 prep: box records, signing host proposal, inputs drafts

- Runbook step 5.0: box identity records come from
  `carlos system box publish-record` (v0.28.1, dev only) run through
  systemd-run as the agent user, one Paul's-go per box (leo, sophie),
  and a rerun on each as the boxid.Verifier check.
- Trusted signing host: throwaway `carlos-claim-signer` instance on the
  root-runner pattern with its own role (may read /carlos/release-key;
  the box-role deny doesn't apply), key in a 0600 tmpfs file, jq and the
  carlos CLI by sha256, teardown and rollback; box helpers move to
  DOCS-T1, files via s3 claim-signer/.
- docs/superpowers/notes/claim-trial-inputs/: regions, leo, sophie,
  console and floor drafts, policy and identity templates, README with
  sources and the TO-CONFIRM list.
- New blocker 5: no tool signs the armed policy without publishing, and
  no system identity exists for any release in the dev bucket.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 1 week ago c29518e2ca4dc2fc2c37805c99a3259abf7da914 parent 34e50b1

10 files changed, +323 −13

docs/superpowers/notes/claim-trial-inputs/README.md +70 −0
docs/superpowers/notes/claim-trial-inputs/console.json +6 −0
docs/superpowers/notes/claim-trial-inputs/floor.json +1 −0
docs/superpowers/notes/claim-trial-inputs/identity.template.json +17 −0
docs/superpowers/notes/claim-trial-inputs/leo.json +10 −0
docs/superpowers/notes/claim-trial-inputs/policy.template.json +7 −0
docs/superpowers/notes/claim-trial-inputs/regions.json +10 −0
docs/superpowers/notes/claim-trial-inputs/signing-host.md +165 −0
docs/superpowers/notes/claim-trial-inputs/sophie.json +10 −0
docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md +27 −13

CI cancelled — superseded by a newer push — run details

CI log

=== gate ===
cd launchctx && go vet ./... && go test ./... -count=1
ok  	amadan.net/carlos/platform.git/launchctx	0.011s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m

amadan: job cancelled — a newer push superseded it

diff --git a/docs/superpowers/notes/claim-trial-inputs/README.md b/docs/superpowers/notes/claim-trial-inputs/README.md

new file mode 100644

index 000000000..47c250619

--- /dev/null

+++ b/docs/superpowers/notes/claim-trial-inputs/README.md

@@ -0,0 +1,70 @@

+# Claim trial inputs, dev cohort 1 (draft for review)

+These are the concrete inputs the runbook's steps 5 to 7 say "the controller supplies and Paul approves" (`docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md`). They were drafted on 2026-10-18 from dev values read with read-only calls. Nothing here is signed, and no secret is in any file. Every value that could not be confirmed read-only is marked `TO-CONFIRM`, with where it comes from.

+Platform main at drafting: `b1118925` (region HA 2b). The box-record verb is on branch `box-publish-record` (`6040bb1c`), merging for v0.28.1.

+## Files

+| File | Used by | Shape |

+|---|---|---|

+| `regions.json` | step 5, `configure` phase | `map[string]hostactors.Region` |

+| `leo.json` | step 5, `invite-box` and `enroll-box` | `claimactivation.BoxInput` |

+| `sophie.json` | step 5, `invite-box` and `enroll-box` | `claimactivation.BoxInput` |

+| `console.json` | step 5, `invite-console` and `enroll-console` (the runbook's `jq` adds `compute` after sophie enrolls) | `hostactors.Console` |

+| `floor.json` | step 7, `publish-floor` | `hostfloor.Floor` |

+| `policy.template.json` | step 6, `guard-arm --policy` | `hostfloor.Policy`, unsigned template |

+| `identity.template.json` | step 6, `guard-arm --identity` | signed system pointer, unsigned template |

+| `signing-host.md` | steps 5 and 7, the trusted signing host | proposal |

+## Values and where they come from

+|---|---|---|---|

+| Pools | `cohort1` (leo), `console` (sophie) | leo: runbook step 4 sets `CARLOS_POOLS=cohort1`. Sophie has no `CARLOS_POOLS`, so it serves the shared `""` pool, but a roster pool must be non-empty; `console` is the tools' fixture name | leo confirmed by ruling; sophie TO-CONFIRM (platform-1e) |

+| Console enrollment | 32 lowercase hex characters | `hostactors` token rule `^[0-9a-f]{32}$`; chosen once at approval and kept | TO-CONFIRM (generated at approval) |

+| Floor | `{"min": 1, "min_release": "v0.28.1"}` | `moves.ProtocolVersion` is `1` on main; v0.28.1 is the first release with the box-record verb | min confirmed; `min_release` TO-CONFIRM until v0.28.1 is published |

+## Release, floor and guard artifacts

+| Artifact | Value | Status |

+|---|---|---|

+| Release for boxes and console | v0.28.1, dev only | TO-CONFIRM: not yet published |

+| Router linux-arm64 sha256 (v0.28.1) | from the signed `SHA256SUMS` of the v0.28.1 release | TO-CONFIRM |

+| Console linux-arm64 sha256 (v0.28.1) | from the same `SHA256SUMS` | TO-CONFIRM |

+| Router linux-arm64 sha256, v0.28.0 (current, for comparison) | `3ca7c74d5356a3995ecf677d142bc32fafaf790a2cc1bc0b628f3eec1b7ea731`, from the signed dev `control/system/router/stable.json` | confirmed |

+| Console executable on sophie | `/opt/carlos/versions/26065378/console` (root-owned; `/opt/carlos/live/platform.dev.carlosframework.com` is a symlink to it in a carlos-owned directory). There is no `.prev` beside it | TO-CONFIRM: `guard-arm --console` needs a root-owned path and a `.prev` that both match the console artifact in the identity |

+| `policy.json` | an armed `hostfloor.Policy` with the floor bytes and a root-signed `moves-protocol` authorization | TO-CONFIRM, and a gap: see below |

+| `identity.json` | the signed system pointer for v0.28.1, `control/system/router/releases/v0.28.1.json` | TO-CONFIRM, and a gap: see below |

+## Gaps found while drafting

+1. **No tool signs the armed policy offline.** `guard-arm` (step 6) refuses anything but `mode: "armed"` with a floor and a valid authorization: a root envelope over `{schema 1, purpose "moves-protocol", deployment_bucket, key "control/moves-protocol.json", sha256 of the floor bytes}`. On main, that authorization is signed only inside `hostfloor.Publish`, which writes it to the bucket, and `PublishFloor` (step 7) refuses unless every actor already reports `FloorGuardReady` for that floor digest, which needs the armed policy. The only other producer, `joinroot.go`, reads an already published floor. So step 6 needs a reviewed way to sign the policy without publishing: for example, a `claims run` phase that signs and prints it on the trusted host. This is for platform-1e.

+2. **No system identity for any release exists in the dev bucket.** `guard-arm --identity` takes a release-workflow signed pointer with `current.release_tag` and `current.moves_protocol >= 1`, stored at `control/system/router/releases/<tag>.json`. The dev bucket holds only `control/system/router/{canary,stable}.json`, whose payloads carry neither field, and `release.PublishSystemIdentity` has no production caller on main. The v0.28.1 release workflow, or platform-1e, must produce and publish it, including the console component for sophie.

+3. **The console needs a root-owned path and a `.prev`.** See the console row above.

+## TO-CONFIRM list

+1. Namespace `platform` (platform-1e).

+2. Sophie's roster pool `console` (platform-1e).

+3. Operator identity for both boxes (Paul).

+4. Console ID `dev-console` (platform-1e).

+5. Console enrollment token (generated at approval).

+6. Floor `min_release` `v0.28.1` (after the release is published).

+7. v0.28.1 router and console sha256 (release `SHA256SUMS`).

+8. Sophie's protected console path and its `.prev` (platform-1e).

+9. `policy.json`: signed armed policy, and the tool to sign it (gap 1).

+10. `identity.json`: signed v0.28.1 system pointer, and who publishes it (gap 2).

+11. Signing host values in `signing-host.md`: the jq and carlos v0.28.1 sha256 values, the security group ID once created, and the bucket keys the runner needs (confirmed by dry runs).

diff --git a/docs/superpowers/notes/claim-trial-inputs/console.json b/docs/superpowers/notes/claim-trial-inputs/console.json

new file mode 100644

index 000000000..48a140ccf

--- /dev/null

+++ b/docs/superpowers/notes/claim-trial-inputs/console.json

@@ -0,0 +1,6 @@

+ "enrollment": "TO-CONFIRM: 32 lowercase hex characters, chosen once at approval and kept",

+ "instance_id": "dev-console",

+ "namespaces": ["platform"],

+ "deployment_bucket": "carlos-dev-640012953448"

diff --git a/docs/superpowers/notes/claim-trial-inputs/floor.json b/docs/superpowers/notes/claim-trial-inputs/floor.json

new file mode 100644

index 000000000..edfa9045c

--- /dev/null

+++ b/docs/superpowers/notes/claim-trial-inputs/floor.json

@@ -0,0 +1 @@

+{"min": 1, "min_release": "v0.28.1"}

diff --git a/docs/superpowers/notes/claim-trial-inputs/identity.template.json b/docs/superpowers/notes/claim-trial-inputs/identity.template.json

new file mode 100644

index 000000000..f2809441c

--- /dev/null

+++ b/docs/superpowers/notes/claim-trial-inputs/identity.template.json

@@ -0,0 +1,17 @@

+ "payload_before_signing": {

+ "schema": 1,

+ "component": "router",

+ "channel": "TO-CONFIRM: stable (leo) / canary (sophie)",

+ "current": {

+ "version": "v0.28.1",

+ "release_tag": "v0.28.1",

+ "moves_protocol": 1,

+ "artifacts": {

+ "linux-arm64": {"key": "bootstrap/router/v0.28.1/carlos-linux-arm64", "sha256": "TO-CONFIRM: v0.28.1 linux-arm64 router sha256"}

+ },

+ "source": "release:v0.28.1"

+ }

+ },

+ "note": "TO-CONFIRM: the real file is the release-workflow signed pointer ({payload, sig}) stored at control/system/router/releases/v0.28.1.json; sophie's guard-arm --console also needs the console component's artifact and sha256 in it (see README)"

diff --git a/docs/superpowers/notes/claim-trial-inputs/leo.json b/docs/superpowers/notes/claim-trial-inputs/leo.json

new file mode 100644

index 000000000..47127ec2b

--- /dev/null

+++ b/docs/superpowers/notes/claim-trial-inputs/leo.json

@@ -0,0 +1,10 @@

+ "reference": "leo-climbing",

+ "namespace": "platform",

+ "label": "leo-climbing",

+ "region": "ie",

+ "pool": "cohort1",

+ "aws_region": "eu-west-1",

+ "instance_id": "i-046c7fe43620944bc",

+ "operator": "TO-CONFIRM: the approving operator's identity string"

diff --git a/docs/superpowers/notes/claim-trial-inputs/policy.template.json b/docs/superpowers/notes/claim-trial-inputs/policy.template.json

new file mode 100644

index 000000000..4b4ae8f1b

--- /dev/null

+++ b/docs/superpowers/notes/claim-trial-inputs/policy.template.json

@@ -0,0 +1,7 @@

+ "schema": 1,

+ "deployment_bucket": "carlos-dev-640012953448",

+ "mode": "armed",

+ "floor": {"min": 1, "min_release": "v0.28.1"},

+ "authorization": "TO-CONFIRM: root-signed envelope of {schema: 1, purpose: \"moves-protocol\", deployment_bucket: \"carlos-dev-640012953448\", key: \"control/moves-protocol.json\", sha256: <sha256 of the exact floor bytes>}; no tool on main produces it offline (see README)"

diff --git a/docs/superpowers/notes/claim-trial-inputs/regions.json b/docs/superpowers/notes/claim-trial-inputs/regions.json

new file mode 100644

index 000000000..229b30b49

--- /dev/null

+++ b/docs/superpowers/notes/claim-trial-inputs/regions.json

@@ -0,0 +1,10 @@

+ "ie": {

+ "namespaces": ["platform"],

+ "pools": ["cohort1", "console"],

+ "account": "640012953448",

+ "aws_region": "eu-west-1",

+ "group_name": "",

+ "group_arn": ""

+ }

diff --git a/docs/superpowers/notes/claim-trial-inputs/signing-host.md b/docs/superpowers/notes/claim-trial-inputs/signing-host.md

new file mode 100644

index 000000000..e2ce6ba0a

--- /dev/null

+++ b/docs/superpowers/notes/claim-trial-inputs/signing-host.md

@@ -0,0 +1,165 @@

+# Trusted signing host for the claim trial (proposal)

+Runbook steps 5 and 7 sign roster, invitation, floor, home and key-binding changes with the dev deployment root key (`/carlos/release-key`). They need a root shell holding `/root/claim-trial`, that key, `jq` and AWS access. DOCS-T1 can't be the host: it is shared and has no sudo. No box can be either, because the key never goes on a box.

+This proposal is a throwaway dev instance built on the existing root-runner pattern: a hand-made instance profile and role, a launch with `aws ec2 run-instances`, SSM only, and termination when done. Nothing here has been created.

+## The root-runner pattern it copies

+The controller's `root-runner.py` (platform-1e's scratch, approved by Paul on 2026-10-14) uses these settings:

+- account `640012953448`, `eu-west-1`;

+- AMI `ami-071babd89cea53fa3` (`debian-13-arm64-20260722-2547`, Debian's own image, the one the dev boxes use);

+- `t4g.small`;

+- subnet `subnet-0975dda9ac0e65347` (`eu-west-1c`, VPC `vpc-02212d67a9fca3b20`, public IP on launch);

+- security group `sg-0c328faf839a02986` (`carlos-root-runner`, no inbound);

+- instance profile and role `carlos-root-runner` (`AmazonSSMManagedInstanceCore` plus S3 on `root-runner/*`);

+- `HttpTokens=required` (IMDSv2), and `instance-initiated-shutdown-behavior terminate`;

+- user data that installs the SSM agent from AWS's regional bucket;

+- the tag `purpose=plan14-root-runner`.

+None of it is in tofu.

+The signer reuses the AMI, type, subnet and launch options. It gets its **own** role and security group: the root-runner role runs arbitrary test binaries and must never be able to read the release key.

+## Separation of duties

+- **The signer** runs only the signing work: `refresh`, `apply_plan` and `phase` from step 5, and the floor, home and bind-key phases of step 7. It has no `ssm:SendCommand`, so it can't reach the boxes.

+- **DOCS-T1** (profile `kass`) runs every box helper (`ssm_run`, `box_get`, `box_put`, `box_inspect`) and the `jq` parsing for the boxes, as in steps 5 to 7 today.

+- **Files move between them** through `s3://carlos-dev-640012953448/claim-signer/<run-id>/`: inputs (`regions.json`, `leo.json` and the rest, plus `release.pub`) down to the signer, and outputs (`inspect.json`, `roster.json`, the enrollment JSON files) back to DOCS-T1.

+- On the signer, `CARLOS=/usr/local/bin/carlos`, and the runbook's `export AWS_PROFILE=kass` line is left out: the signer uses its instance role.

+## Instance

+| Setting | Value |

+|---|---|

+| Type | `t4g.small` (arm64) |

+| AMI | `ami-071babd89cea53fa3` |

+| Subnet | `subnet-0975dda9ac0e65347` (public IP for egress only) |

+| Security group | new `carlos-claim-signer`: no inbound; egress TCP 443 only (SSM, S3). Amazon's VPC DNS is not filtered by security groups |

+| Access | SSM Session Manager only. No SSH key, no inbound port |

+| Metadata | IMDSv2 required, hop limit 1 |

+| Storage | default root volume, deleted on termination. No swap (Debian cloud default), so a key in `/run` stays in memory |

+| Lifetime | one instance per signing session (step 5, then step 7), terminated straight after each |

+| Tags | `Name=carlos-claim-signer`, `purpose=claim-signer` |

+## IAM role `carlos-claim-signer`

+Trust: `ec2.amazonaws.com`. Managed policy: `AmazonSSMManagedInstanceCore` (Session Manager). Inline policy `claim-signer`:

+```json

+ "Version": "2012-10-17",

+ "Statement": [

+ {"Sid": "ReleaseKey", "Effect": "Allow", "Action": "ssm:GetParameter",

+ "Resource": "arn:aws:ssm:eu-west-1:640012953448:parameter/carlos/release-key"},

+ {"Sid": "ListForNotFound", "Effect": "Allow", "Action": "s3:ListBucket",

+ "Resource": "arn:aws:s3:::carlos-dev-640012953448",

+ "Condition": {"StringLike": {"s3:prefix": ["control/*", "status/boxes/*", "claim-signer/*"]}}},

+ {"Sid": "ReadControl", "Effect": "Allow", "Action": "s3:GetObject",

+ "Resource": ["arn:aws:s3:::carlos-dev-640012953448/control/*",

+ "arn:aws:s3:::carlos-dev-640012953448/status/boxes/*"]},

+ {"Sid": "WriteRosterAndFloor", "Effect": "Allow", "Action": "s3:PutObject",

+ "Resource": ["arn:aws:s3:::carlos-dev-640012953448/control/host-actors.json",

+ "arn:aws:s3:::carlos-dev-640012953448/control/host-actor-invitations/*",

+ "arn:aws:s3:::carlos-dev-640012953448/control/host-console-invitations/*",

+ "arn:aws:s3:::carlos-dev-640012953448/control/moves-protocol.json",

+ "arn:aws:s3:::carlos-dev-640012953448/control/moves-protocol-auth.json"]},

+ {"Sid": "Exchange", "Effect": "Allow", "Action": ["s3:GetObject", "s3:PutObject"],

+ "Resource": "arn:aws:s3:::carlos-dev-640012953448/claim-signer/*"}

+ ]

+```

+Why each statement:

+- **ReleaseKey:** the parameter is a SecureString under the AWS-managed `alias/aws/ssm` key, so `ssm:GetParameter` alone decrypts it; no KMS grant is needed.

+- **ListForNotFound:** without `s3:ListBucket`, S3 answers a missing key with 403 instead of 404, and the runner's first `initialize` reads a roster that doesn't exist yet.

+- **WriteRosterAndFloor:** these are exactly the runner's write allowlist (`internal/claimactivation/runner.go:89-104`).

+- **ReadControl:** covers the reads for invitations, box records and floor evidence. Confirm it with a `--dry-run` of every phase from the signer, and widen only on a refusal.

+**The release-key deny doesn't block this role.** That deny is the inline policy `deny-release-key-reads` on the box roles only (`carlos-dev-host`, `carlos-dev-host-b`). Dev-uk's role is limited by its own eu-west-2 scope. There is no account-wide deny. A policy simulation of this `ReleaseKey` statement returns `allowed` (2026-10-18). Because any role granted `ssm:GetParameter` on that ARN can read the key, the role exists only for the trial and is deleted afterwards. CloudTrail is checked so that every `GetParameter` on `/carlos/release-key` comes from a `carlos-claim-signer` session.

+## Getting the key there

+As root, in a Session Manager shell on the signer:

+```bash

+install -d -m 0700 -o root -g root /run/claim-signer

+aws --region eu-west-1 ssm get-parameter --name /carlos/release-key --with-decryption \

+ --query Parameter.Value --output text | install -m 0600 -o root -g root /dev/stdin /run/claim-signer/release.key

+stat -c '%U %a %h %s' /run/claim-signer/release.key

+```

+The key goes from the SSM response straight into a `0600` file on tmpfs (`/run`). It is never written to disk, never passed as a command-line argument, and never printed, so Session Manager logging never sees it. Step 5's `KEY` becomes `/run/claim-signer/release.key`; `claims run --signing-key` requires a root-owned `0600` or `0400` file, which this is. `release.pub` is the public key, copied from any dev box's `CARLOS_RELEASE_PUBKEY`.

+## Getting jq and the carlos CLI there

+On DOCS-T1, before launching:

+1. Download carlos v0.28.1 `carlos-linux-arm64`, with its `SHA256SUMS` and `SHA256SUMS.sig`, from the public release. Verify the signature as the README's "Releasing the platform" verification does, then `sha256sum -c`. Record the sha256.

+2. Download jq 1.7.1 `jq-linux-arm64` and the release's `sha256sum.txt` from `github.com/jqlang/jq/releases/tag/jq-1.7.1`, then check it with `sha256sum -c`. Record the sha256.

+3. Upload both to `s3://carlos-dev-640012953448/claim-signer/<run-id>/`.

+On the signer, as root:

+```bash

+aws s3 cp s3://carlos-dev-640012953448/claim-signer/<run-id>/carlos-linux-arm64 /usr/local/bin/carlos

+aws s3 cp s3://carlos-dev-640012953448/claim-signer/<run-id>/jq-linux-arm64 /usr/local/bin/jq

+printf '%s %s\n' '<carlos v0.28.1 sha256>' /usr/local/bin/carlos '<jq 1.7.1 sha256>' /usr/local/bin/jq | sha256sum -c

+chmod 0755 /usr/local/bin/carlos /usr/local/bin/jq

+/usr/local/bin/carlos version

+```

+Expected: both `OK`, then `carlos v0.28.1`. Both sha256 values are TO-CONFIRM: v0.28.1 is not published yet, and the jq value is recorded at download.

+## Create (each part needs Paul's go)

+From DOCS-T1, profile `kass`, with the trust and inline policies saved as `signer-trust.json` and `signer-policy.json`, and the root runner's user data as `signer-user-data.sh`:

+```bash

+export AWS_PROFILE=kass AWS_REGION=eu-west-1

+aws iam create-role --role-name carlos-claim-signer --assume-role-policy-document file://signer-trust.json \

+ --tags Key=purpose,Value=claim-signer

+aws iam attach-role-policy --role-name carlos-claim-signer --policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore

+aws iam put-role-policy --role-name carlos-claim-signer --policy-name claim-signer --policy-document file://signer-policy.json

+aws iam create-instance-profile --instance-profile-name carlos-claim-signer

+aws iam add-role-to-instance-profile --instance-profile-name carlos-claim-signer --role-name carlos-claim-signer

+SG=$(aws ec2 create-security-group --group-name carlos-claim-signer --description "claim signer: SSM only, no inbound" \

+ --vpc-id vpc-02212d67a9fca3b20 --query GroupId --output text)

+aws ec2 revoke-security-group-egress --group-id "$SG" --ip-permissions '[{"IpProtocol":"-1","IpRanges":[{"CidrIp":"0.0.0.0/0"}]}]'

+aws ec2 authorize-security-group-egress --group-id "$SG" --ip-permissions '[{"IpProtocol":"tcp","FromPort":443,"ToPort":443,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]}]'

+I=$(aws ec2 run-instances --image-id ami-071babd89cea53fa3 --instance-type t4g.small --subnet-id subnet-0975dda9ac0e65347 \

+ --security-group-ids "$SG" --iam-instance-profile Name=carlos-claim-signer --instance-initiated-shutdown-behavior terminate \

+ --metadata-options HttpTokens=required,HttpPutResponseHopLimit=1 --user-data file://signer-user-data.sh \

+ --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=carlos-claim-signer},{Key=purpose,Value=claim-signer}]' \

+ --query 'Instances[0].InstanceId' --output text)

+aws ssm start-session --target "$I"

+```

+The instance profile can take a few seconds to become usable. If `run-instances` refuses it, wait and retry.

+## Teardown, which is also the rollback from any point

+On the signer, before leaving the session:

+```bash

+shred -u /run/claim-signer/release.key && rmdir /run/claim-signer

+```

+On tmpfs, `shred` adds little over `rm`; the termination below destroys the memory either way. Then, from DOCS-T1:

+```bash

+aws ec2 terminate-instances --instance-ids "$I" && aws ec2 wait instance-terminated --instance-ids "$I"

+aws s3 rm "s3://carlos-dev-640012953448/claim-signer/<run-id>/<each exact key>"

+```

+After step 7, when no more signing is needed:

+```bash

+aws iam remove-role-from-instance-profile --instance-profile-name carlos-claim-signer --role-name carlos-claim-signer

+aws iam delete-instance-profile --instance-profile-name carlos-claim-signer

+aws iam delete-role-policy --role-name carlos-claim-signer --policy-name claim-signer

+aws iam detach-role-policy --role-name carlos-claim-signer --policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore

+aws iam delete-role --role-name carlos-claim-signer

+aws ec2 delete-security-group --group-id "$SG"

+```

+Checks: `describe-instances` with `tag:purpose=claim-signer` shows nothing running; `get-role` answers `NoSuchEntity`; CloudTrail `GetParameter` events on `/carlos/release-key` come only from `carlos-claim-signer` sessions inside the trial window.

diff --git a/docs/superpowers/notes/claim-trial-inputs/sophie.json b/docs/superpowers/notes/claim-trial-inputs/sophie.json

new file mode 100644

index 000000000..93694518d

--- /dev/null

+++ b/docs/superpowers/notes/claim-trial-inputs/sophie.json

@@ -0,0 +1,10 @@

+ "reference": "sophie-knitting",

+ "namespace": "platform",

+ "label": "sophie-knitting",

+ "region": "ie",

+ "pool": "console",

+ "aws_region": "eu-west-1",

+ "instance_id": "i-05498eada6f0afd23",

+ "operator": "TO-CONFIRM: the approving operator's identity string"

diff --git a/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md b/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md

index bb22a285c..72ce32f97 100644

--- a/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md

+++ b/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md

@@ -196,15 +196,8 @@ Pass: all twelve are root-owned regular files in `/etc/systemd/system`; the edge

3. **IAM.** Leo's object-version actions were applied on 2026-10-18 (targeted, `0 to add, 1 to change, 0 to destroy`): the claim's data store lists, reads and deletes object versions in `carlos-dev-ie-640012953448` on the seed and cold-wake paths. The fence-writer role (`carlos-dev-ie-b-fence-writer`, bootstrap user `carlos-dev-ie-b-fence-writer-root`, no access key yet) and the deployment bucket policy were applied on 2026-10-18 from the saved targeted plan (`5 added, 0 changed, 0 destroyed`) and merged as platform-infrastructure#46 (`beb346b`). The bucket policy names that role as the only fence writer. After the apply, wakecheck still served on sophie (200) and leo answered `waking elsewhere` (sophie held the lease), with no AccessDenied in either box's journals. Step 3.

4. **Box identity records.** Step 5's enrollment needs each box's signed AWS identity record at `control/boxes/<box>.json`. None exists, and none has ever been written: the publisher (`internal/host/boxrecord.go`, `boxRecordLoop`) runs only with `CARLOS_REGION_HA` on, which is off on every dev box. Leo's and sophie's records must be published before step 5. Paul ruled a reviewed one-off publish, with region HA staying off.

- There is no supported way today. `carlos system box` only sets roles (`system_roles.go`), and the only caller of `publishBoxRecord` (`internal/host/boxrecord.go:121`) is the agent's `boxRecordLoop`, which returns at once unless `CARLOS_REGION_HA` is on. Records are never hand-written.

- Status: being built (claim-owned, after region HA 2b). The design is the proposal below.

- Proposal, the smallest platform change: a verb `carlos system box publish-record` that calls the existing `publishBoxRecord` once with the box's own label (`metricsBoxLabel`) and `readIdentityRecord`, without the region HA gate, and refuses on fleet boxes as the loop does (`shouldSkipPublisherElection`). It writes `control/boxes/<box>.json` create-only through the box's own credentials. The record is `{v: 1, box, identity_document, identity_signature, written_at}`: the instance identity document from IMDS (base64) and AWS's RSA-SHA256 signature over it, checked later against the embedded regional AWS certificates. It is AWS-signed, not signed by the box or the operator, and grants nothing until enrollment reads it. An existing record for the same instance is a no-op; one for another instance is refused. Cost:

- - about 40 lines plus tests (parse; no-op on the same instance; refusal on a different instance; refusal on a fleet box; no region HA needed), reusing `publishBoxRecord`'s existing tests;

- - copy: the usage line, the published and already-in-place lines, the refusals, and a `docs/site/cli.md` paragraph, for Paul's copy review;

- - census: a new root-path unit for the Plan 14 root-read overlay, and a new caller at the existing `boxid.Publish` key-site for the Plan 9 B8 record-write census;

- - a release and a dev roll before step 5, then one run on leo and one on sophie, each with Paul's go.

+ The verb `carlos system box publish-record` (branch `box-publish-record`, merging now) ships in v0.28.1, dev only, and is the supported way. It replaces the agent's region-HA-only publisher for this trial; step 5.0 runs it once per box. The record is AWS-signed (the EC2 instance identity document and AWS's signature over it), not signed by the box or the operator, and grants nothing until enrollment reads it.

+5. **Signed armed policy and system identity.** Step 6's `guard-arm` needs an armed `policy.json` (the floor plus a root-signed `moves-protocol` authorization) and a signed v0.28.1 system identity at `control/system/router/releases/v0.28.1.json`. No tool on main signs the policy without publishing it, and nothing publishes a system identity; the dev bucket has none. Details in `docs/superpowers/notes/claim-trial-inputs/README.md`, "Gaps found while drafting". For platform-1e.

## Accepted trial gaps

@@ -342,16 +335,35 @@ Run signing phases on the trusted operator host. Run box installers as root.

**No new tools on the boxes (platform-1e, 2026-10-17).** `jq` is not installed on leo or sophie, and nothing is installed for the trial. Every `jq` line runs on the trusted signing host. A box writes raw JSON (`inspect.json`, `key-proof.json`) to a file; the trusted host fetches it over SSM, parses it there, and stages the results (`roster.json`, `rev`, `le`) back on the box over SSM. The box commands read those files with `cat`. A wrong or stale staged roster is refused, because `console-config` and `evidence-key` verify the roster's signature and its revision against `--expect-revision`.

Where they run:

-- **The trusted signing host:** a root shell holding `/root/claim-trial` with `release.pub`, `release.key`, `regions.json`, `leo.json`, `sophie.json`, `console.json` and `floor.json`, plus `jq`, the AWS CLI with profile `kass`, `gzip` and `base64`. The release signing key never goes on either box.

+- **The trusted signing host:** a throwaway dev instance, `carlos-claim-signer`, proposed in `docs/superpowers/notes/claim-trial-inputs/signing-host.md` (root-runner pattern, SSM only, its own role that may read `/carlos/release-key`). It holds `/root/claim-trial` with the inputs, the key in a `0600` tmpfs file at `/run/claim-signer/release.key`, `jq` and the carlos v0.28.1 CLI, both checked by sha256. It runs only the signing helpers (`refresh`, `apply_plan`, `phase`) with its instance role; set `KEY=/run/claim-signer/release.key` and `CARLOS=/usr/local/bin/carlos`, and leave out `export AWS_PROFILE=kass`. The release signing key never goes on either box.

+- **The operator host (DOCS-T1, profile `kass`):** runs the box helpers below (`ssm_run`, `box_get`, `box_put`, `box_inspect`) and the `jq` parsing for the boxes. Files move between the signer and DOCS-T1 through `s3://carlos-dev-640012953448/claim-signer/<run-id>/`.

- **Leo and sophie:** attended root shells for the box blocks, which use only the platform binary, `systemctl` and the shell. Inputs are staged at the exact paths shown, root-owned, private files `0600`, no symlinks or extra hard links. Staging is a checkpoint, not permission to make up signatures.

-The controller supplies, and Paul approves, the concrete inputs: the signed release, floor and guard artifacts; namespace, pool and label inputs (leo's pool `cohort1`, sophie's matching its real placement); the console identity; the fence role and credentials from step 3; and leo's reviewed host.env changes. Revalidate both instance IDs first.

+The controller supplies, and Paul approves, the concrete inputs: the signed release, floor and guard artifacts; namespace, pool and label inputs (leo's pool `cohort1`, sophie's matching its real placement); the console identity; the fence role and credentials from step 3; and leo's reviewed host.env changes. Revalidate both instance IDs first. The drafts, with every value that could not be confirmed read-only marked `TO-CONFIRM`, are in `docs/superpowers/notes/claim-trial-inputs/`.

## Step 5. Roster, enrollment and console enrollment

Paul's go: once for step 5.

-Each box's signed AWS identity record must already be published by the existing box identity mechanism. A missing record is a stop, not permission to make one up.

+### 5.0 Box identity records

+Each box's signed AWS identity record must be in place at `control/boxes/<box>.json` before the box is invited. They come from `carlos system box publish-record` (v0.28.1, dev only), run once on each box. A missing or refused record is a stop, not permission to make one up.

+**Leo.** Paul's go: separate. In a root shell on leo (the verb refuses to run as root, so `systemd-run` drops to the agent user with the box's host.env loaded; this is the only supported way to run it):

+```bash

+systemd-run --wait --pipe -p EnvironmentFile=/etc/carlos/host.env -p User=carlos /opt/carlos/carlos system box publish-record

+```

+Expected: `published the identity record for leo-climbing (instance i-046c7fe43620944bc) to control/boxes/leo-climbing.json`.

+**Sophie.** Paul's go: separate. The same command in a root shell on sophie. Expected: `published the identity record for sophie-knitting (instance i-05498eada6f0afd23) to control/boxes/sophie-knitting.json`.

+**Check that each record verifies (`boxid.Verifier`).** Run the same command again on each box. On an existing record it verifies it the way enrollment does (`boxid.Verifier.Enroll`: AWS's signature under the certificate for the document's region, the account, the AWS region, the instance and the box name) and writes nothing. Expected on each box: `the record at control/boxes/<box>.json is valid AWS-signed evidence for <box> (instance <id>), so nothing was written. enrollment still makes its own checks before it accepts the box`. Any other answer is a stop. The `invite-box` dry run below then checks the same evidence again, from the signer.

+These output lines are drafts on the `box-publish-record` branch and may change in copy review; match the final v0.28.1 wording.

+### 5.1 Roster and enrollment

On the trusted signing host, the helpers. The first block is the report's; the second adds the SSM transfer helpers that replace `jq` on the boxes:

@@ -1403,5 +1415,7 @@ For platform-1e:

1. Should `hostops.Apps` skip an empty app segment instead of refusing, so one stray object cannot stop activation on a whole deployment?

2. For a later teardown out of hold: how do writes made under the claim reach the claims-off restore path?

3. Answered 2026-10-18: leo's object-version actions are applied for the trial; the box-records bucket policy goes with the fence-writer role in platform-infrastructure#46.

-4. Box identity records: Paul ruled a reviewed one-off publish with region HA off. The `carlos system box publish-record` verb (blocker 4) is being built, claim-owned, after region HA 2b. It still needs copy review, census rows, a release and a dev roll.

+4. Box identity records: `carlos system box publish-record` ships in v0.28.1, dev only (step 5.0). The v0.28.1 dev roll comes before step 5.

+6. The signed armed policy and the v0.28.1 system identity (blocker 5): which tool signs the policy without publishing it, and who publishes the identity?

+7. The step 5 inputs marked `TO-CONFIRM` in `docs/superpowers/notes/claim-trial-inputs/README.md`, and the signing host proposal in `signing-host.md`.

5. The console's mutation classifier lets it delete under `control/boxes/` and `control/box-volumes/`, which the new box-records bucket policy refuses: amadan carlos/platform#302.