carlos / platform Public

README: approved copy for the config guard (#213)

Step 1 of Turning app regions on says a keyless box refuses sealed placed exec
instances, and the box configuration list documents CARLOS_NO_SEALED_CONFIG.
The approved-copy record carries the new step 1 text.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 2 weeks ago e03196e5da6510a3a2475a179e836bf1b10ca947 parent 699c6c7

2 files changed, +7 −3

README.md +6 −2
docs/superpowers/plans/2026-10-02-nearest-region-copy.json +1 −1

CI passed — run details

diff --git a/README.md b/README.md

index 22a5c3dca..1df305411 100644

--- a/README.md

+++ b/README.md

@@ -276,8 +276,8 @@ own rollback: it stops new non-home regions and keeps existing ones in force.

1. Stage the deployment's `CARLOS_SECRETS_KEY` on every box in every region

that should take placed instances, and set `CARLOS_SECRETS_PUBKEY` on the

- console. A box without the key runs placed instances with no config, no

- secrets and no store.

+ console. A box without the key refuses to mint or wake placed exec instances

+ whose config contains sealed secrets.

2. Roll the box release that publishes `serves_shared_pool`,

`accepts_inbound` and `secrets_key_fp`. Check every region's

`control/edges/*.json` carries them, and that each `secrets_key_fp` equals

@@ -601,6 +601,10 @@ no single reader owns the whole contract:

`status/fleet.json` itself under that prefix too — moot today, since

nothing sets a prefix on a publishing (non-fleet) box, and a fleet box

never publishes at all (see `CARLOS_FLEET`, below).

+- A box with `CARLOS_HIBERNATE_BUCKET` set but no deployment store

+ (`CARLOS_DEPLOYMENT_BUCKET` or `CARLOS_DEPLOYMENT_DIR`) refuses placed exec

+ instances, because it cannot tell whether their config is sealed. Set

+ `CARLOS_NO_SEALED_CONFIG=1` to say this deployment has none.

- `CARLOS_FLEET` — read by `carlos agent`'s status loop (customer-fleets

plan, Task 5). Set (to the fleet's name) marks this agent as a fleet box:

it still self-reports its own snapshot every tick, but never contends for

diff --git a/docs/superpowers/plans/2026-10-02-nearest-region-copy.json b/docs/superpowers/plans/2026-10-02-nearest-region-copy.json

index 9a15c3d8c..addb19a06 100644

--- a/docs/superpowers/plans/2026-10-02-nearest-region-copy.json

+++ b/docs/superpowers/plans/2026-10-02-nearest-region-copy.json

@@ -597,7 +597,7 @@

{

"id": "D7",

"file": "README.md",

- "text": "**Turning app regions on.** In order:\n\n1. Stage the deployment's `CARLOS_SECRETS_KEY` on every box in every region\n that should take placed instances, and set `CARLOS_SECRETS_PUBKEY` on the\n console. A box without the key runs placed instances with no config, no\n secrets and no store.\n2. Roll the box release that publishes `serves_shared_pool`,\n `accepts_inbound` and `secrets_key_fp`. Check every region's\n `control/edges/*.json` carries them, and that each `secrets_key_fp` equals\n the console's.\n3. Roll the console with the switch off.\n4. On dev, turn the switch on. Create an app and an instance, read their\n region, and run the service gate below for every region.\n5. On production, with the switch still off, create one probe instance per\n eligible region with an explicit `--region`, deploy a known build, and run\n `scripts/region-service-gate.sh <probe-host> <build> <every other edge EIP>`\n for each. Every region must pass. Delete the probes.\n6. Turn the switch on. Re-run step 5 after any period with the switch off,\n and whenever a new region becomes eligible."

+ "text": "**Turning app regions on.** In order:\n\n1. Stage the deployment's `CARLOS_SECRETS_KEY` on every box in every region\n that should take placed instances, and set `CARLOS_SECRETS_PUBKEY` on the\n console. A box without the key refuses to mint or wake placed exec instances\n whose config contains sealed secrets.\n2. Roll the box release that publishes `serves_shared_pool`,\n `accepts_inbound` and `secrets_key_fp`. Check every region's\n `control/edges/*.json` carries them, and that each `secrets_key_fp` equals\n the console's.\n3. Roll the console with the switch off.\n4. On dev, turn the switch on. Create an app and an instance, read their\n region, and run the service gate below for every region.\n5. On production, with the switch still off, create one probe instance per\n eligible region with an explicit `--region`, deploy a known build, and run\n `scripts/region-service-gate.sh <probe-host> <build> <every other edge EIP>`\n for each. Every region must pass. Delete the probes.\n6. Turn the switch on. Re-run step 5 after any period with the switch off,\n and whenever a new region becomes eligible."

{

"id": "D8",