carlos / platform Public

spec: the artifact target is the part name — meta carries no per-file fields

Final-review alignment: §2 described a meta 'target per file' field the
implementation (correctly) never grew.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Paul Campbell c6a264683d8fad7a7bd0c2abc434c9ee81c953e0 parent 32c4e9b
1 file changed, +4 −2
  • docs/superpowers/specs/2026-08-03-cli-console-api-design.md +4 −2
diff --git a/docs/superpowers/specs/2026-08-03-cli-console-api-design.md b/docs/superpowers/specs/2026-08-03-cli-console-api-design.md
index ab7ac1e20..3e98633e2 100644
--- a/docs/superpowers/specs/2026-08-03-cli-console-api-design.md
+++ b/docs/superpowers/specs/2026-08-03-cli-console-api-design.md
@@ -64,8 +64,10 @@ semantics — a hand-written request meets exactly the checks a button does:
- `GET /api/cli/apps/{account}/{app}/channels` — channel pointers:
channel, version, promoted_at, rung. Powers `carlos channels`.
- `POST /api/cli/apps/{account}/{app}/releases` — ship. Multipart:
- `meta` part (JSON: version, kind binary|static, target per file) then one
- or more artifact parts. Server computes sha256 and sizes from the bytes it
+ `meta` part (JSON: version, kind binary|static) then one or more artifact
+ parts, each part NAMED by its target (`linux-arm64`, …, or `site.tar.gz`
+ for static) — the part name is the artifact key; meta carries no
+ per-file fields. Server computes sha256 and sizes from the bytes it
received — the client never states a hash it could lie about — builds the
manifest exactly as `runShip` does (target-keyed artifacts; `BuiltBy:
"console-api <console version>"`), and calls `release.Ship` against its