carlos / platform Public

The handoff records the replicator's link fix and the full shared /tmp that failed one gate run

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

claude 3 weeks ago c68ecddd8ac13b76fb80782c88205c1753b161d1 parent 8897e95

2 files changed, +9 −5

.claude/HANDOFF.md +8 −4
implementation/carloku-paid-launch/OUTSTANDING.md +1 −1

CI passed — run details

diff --git a/.claude/HANDOFF.md b/.claude/HANDOFF.md

index 067636710..15f6596a3 100644

--- a/.claude/HANDOFF.md

+++ b/.claude/HANDOFF.md

@@ -7,7 +7,7 @@

Get Carloku's paid plans live with Stripe Tax and the complete metered model; have the pricing page and signup flow reviewable in the morning.

**STATUS:**

-Written 10:15 Dublin on 2026-10-01. Three things, kept apart.

+Written 10:27 Dublin on 2026-10-01. Three things, kept apart.

1. Draft copy to review, not approved: pricing http://100.119.180.57:38009 (name form http://docs-t1.tail5fd3ba.ts.net:38009), console billing page http://100.119.180.57:45033 (name form http://docs-t1.tail5fd3ba.ts.net:45033).

2. A demo to click through: http://100.119.180.57:41881, real console handlers with Keymail and Stripe simulated. It is not Stripe proof.

@@ -32,7 +32,7 @@ Two open defects, both with their paths disabled, neither offered as a risk to a

Side branches, all on the forge, none run through CI, nothing on the launch branch calls them. Each has now had one review by both reviewers, and none passed:

- `feat/carloku-late-request-fencing-20261001` (`157f0de8`, full local gate passes): a Stripe request cannot outlive its connection, and a void for a wrong-total invoice (remediation only). Both reviewers rejected it at `1772e840`. Four findings are fixed since. One finding limits the design: the provider's idle-connection limit bounds when a request can begin to be written, not when a whole request is received. As designed the branch does not close the two defects. Open items: `DISPOSITIONS-late-request-fencing.md` on that branch.

-- `feat/carloku-metered-replicator-20261001` (`40558c1d`; code `ebab1a37`, full local gate passes): path B, first pieces. Both reviewers rejected it: the owner of a database is resolved once and never re-checked, and paths are compared as text, so a symlink can bill one tenant for another's database. Nothing fixed yet. `DISPOSITIONS-metered-replicator.md` on that branch.

+- `feat/carloku-metered-replicator-20261001` (`1df73b02`, full local gate passes): path B, first pieces. Both reviewers rejected it at `ebab1a37`. Fixed since: ownership is decided on the file and not the path's spelling, so a tenant's link is refused, and shadow state left the tenant's directory. Open: the owner of a database is resolved once and never re-checked (the other P1), and the rest of `DISPOSITIONS-metered-replicator.md` on that branch.

- `feat/carloku-bucket-hour-evidence-20261001` (`b50f29bc`; code `58c1870c`, full local gate passes): the operator evidence door for a store's partial first hour. Astra rejected it, Opus accepted with fixes. Both confirmed it releases only that hour for the owner the ledger names. Both found the evidence is free text one operator records, which in practice is a waiver. That needs Paul's ruling (approval J in `OUTSTANDING.md`). Nothing fixed yet. `DISPOSITIONS-bucket-hour-evidence.md` on that branch.

- `feat/carloku-scoped-attestation-20261001` (`058ea506`): path A, parked. It cannot prove an exclusive writer. Replication-write completeness is a launch blocker, not waived.

@@ -41,11 +41,15 @@ Side branches, all on the forge, none run through CI, nothing on the launch bran

- Scoped approvals, prepared as plans only: Stripe test mode, to run `TestSandboxQuantityFence`; the `rk_live` restricted key and Stripe catalog; the Cost and Usage Report export; one scratch-object write to check S3's conditional delete. Exact scopes are in the approvals table of `OUTSTANDING.md`.

**RECOMMENDED:**

-- Replicator branch: fix the two P1s (bind ownership to the registry generation and re-check it; compare files by identity, not path text), then the rest of its dispositions.

+- Replicator branch: fix the remaining P1 (bind ownership to the registry generation and re-check it), then the rest of its dispositions.

- Decide what bounds a complete late request at Stripe, or redesign so nothing depends on it. The fencing branch's remaining items are the void's fixed key, the sandbox probe and three transport tests.

- Evidence door: after the ruling, withdrawal by entry, audit correctness, a canonical pin, and the refusal of a withdrawal that would invalidate a closed month.

- Have the whole launch branch read again at its tip, not a diff, before anything is called accepted.

- Then, each on its own branch: the storage pass using the holder inventory (19i), quantity reduction at renewal, the evidence door for a box's first minutes, the AWS principal inventory and the bucket ownership attestation door, Free-tier enforcement, dormancy and pool accounting.

**SESSION:**

-A bounded heartbeat (`carloku-paid-launch-continuity`, id `a1f7c9af`, every 30 minutes, six runs at most, three hours) returns to this same agent from 10:00 Dublin. Not safe to close without a look: three review servers are serving on this box (pids and stop file under `/home/paulca/.local/share/carloku-paid-launch-20260930/logs`), and two review processes may still be running. Scratch left on the box: `~/.cache/tmp/claude-1001/{mutcopy,fencing-wt,replicator-wt,evidence-wt}` (the last three are git worktrees), `/tmp/k`, `~/.cache/carloku-gate`.

+A bounded heartbeat (`carloku-paid-launch-continuity`, id `a1f7c9af`, every 30 minutes, six runs at most, three hours) returns to this same agent from 10:00 Dublin. Not safe to close without a look: three review servers are serving on this box (pids and stop file under `/home/paulca/.local/share/carloku-paid-launch-20260930/logs`).

+The shared `/tmp` on this box was 99% full at 10:16 (about 478 MB free of 32 GB). Most of it is not this run's: `/tmp/titogo-admission-go-cache` (8.0 GB), `/tmp/admission-repair-cache` (6.5 GB, still growing), `/tmp/g` (3.2 GB) and two CI runner directories. This run did not touch them. It failed one gate run (tests that build a binary could not link). The gate wrapper (`~/.cache/carloku-gate/texec.sh`) now gives every package but the activator an on-disk scratch root, `/var/tmp/ck`; the activator keeps `/tmp/k` because its unix socket paths do not fit under a longer root.

+Scratch left on the box: `~/.cache/tmp/claude-1001/{mutcopy,fencing-wt,replicator-wt,evidence-wt}` (the last three are git worktrees), `/tmp/k`, `/var/tmp/ck`, `~/.cache/carloku-gate`.

diff --git a/implementation/carloku-paid-launch/OUTSTANDING.md b/implementation/carloku-paid-launch/OUTSTANDING.md

index 708127eca..5aac89c6e 100644

--- a/implementation/carloku-paid-launch/OUTSTANDING.md

+++ b/implementation/carloku-paid-launch/OUTSTANDING.md

@@ -32,7 +32,7 @@ Each is concrete. None is waived.

### Meters (the complete metered model cannot invoice until both are proven)

-1. **Replication writes (`durability_writes_1k`) cannot be proven on any box.** The external replicator writes outside the ledger. Path A (scoped attestation) was built, reviewed in round six, and cannot prove an exclusive writer; it is off this branch and parked on `feat/carloku-scoped-attestation-20261001`. Path B (the platform's own replicator as the only writer) is **partial, unwired**, on `feat/carloku-metered-replicator-20261001` (`40558c1d`, on the forge; the full local gate passes on its code, `ebab1a37`; first review: both reviewers rejected it, on an owner resolved once and never re-checked and on paths compared as text, among others; nothing fixed yet, see `DISPOSITIONS-metered-replicator.md` on that branch): a litestream store whose every replica client is metered with no unmetered fallback, an owner for each database the box replicates, and a fleet store that refuses anything it cannot meter, each with tests. **Absent**: the agent wiring that binds those meters to the box's ledger, a restore path that does not shell out to the external binary, the unit change, moving the replica credentials so nothing else on the box holds them (the unit runs as the same user as the agent today), and any attestation. Until all of that exists and is approved for a box, this meter is incomplete every month and nothing is invoiced.

+1. **Replication writes (`durability_writes_1k`) cannot be proven on any box.** The external replicator writes outside the ledger. Path A (scoped attestation) was built, reviewed in round six, and cannot prove an exclusive writer; it is off this branch and parked on `feat/carloku-scoped-attestation-20261001`. Path B (the platform's own replicator as the only writer) is **partial, unwired**, on `feat/carloku-metered-replicator-20261001` (`1df73b02`, on the forge; the full local gate passes on it; first review: both reviewers rejected it, on an owner resolved once and never re-checked and on paths compared as text, among others. The second is fixed: ownership is decided on the file, a tenant's link is refused, shadow state left the tenant's directory. The first and the rest are open, see `DISPOSITIONS-metered-replicator.md` on that branch): a litestream store whose every replica client is metered with no unmetered fallback, an owner for each database the box replicates, and a fleet store that refuses anything it cannot meter, each with tests. **Absent**: the agent wiring that binds those meters to the box's ledger, a restore path that does not shell out to the external binary, the unit change, moving the replica credentials so nothing else on the box holds them (the unit runs as the same user as the agent today), and any attestation. Until all of that exists and is approved for a box, this meter is incomplete every month and nothing is invoiced.

2. **Store transfer (`store_egress_gb`) has no source.** No Cost and Usage Report export exists on the account. It needs the scoped infrastructure approval, a first real delivery, an IAM principal inventory in the AWS provisioner (not built), and the bucket ownership attestation for stores that already exist (designed, not built).

3. **A store's partial first hour** with a charged line holds the month, and nothing releases it. It holds by default and nobody is asked to waive it. What can release it is evidence: an operator door that records, for one bucket-hour, who is shown to have owned it and on what evidence, which the fold then honours. **Partial, unwired into this branch**, on `feat/carloku-bucket-hour-evidence-20261001` (`b50f29bc`; code at `58c1870c`): the record, the fold change and three operator API doors, with tests and mutation checks. It accepts only the hour a complete ledger began vouching in and only the owner that ledger names. The full local gate passes on it. First review: Astra rejected it, Opus accepted with fixes. Both confirmed that through the fold it releases nothing but that hour for that owner. Both also found that the evidence is free text that the same operator records and that stands at once, which in practice is a waiver: what counts as evidence, and whether a second person must approve it, needs Paul's ruling (approval J) before more is built. Nothing fixed yet (`DISPOSITIONS-bucket-hour-evidence.md` on that branch). No CI run, no CLI verb, and its operator-facing sentences are unreviewed.

4. **A box's first minutes** before its ledger opened hold that day for everyone. Same as item 3: it holds by default, and the release is an operator evidence door, not a waiver. **Absent**.