amadan
The handoff names abc9f781 as the code tip with its gate, review and CI state, and makes no claim about later commits
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
1 file changed,
+28
−14
.claude/HANDOFF.md+28 −14
diff --git a/.claude/HANDOFF.md b/.claude/HANDOFF.md| index 1352afc6c..3e118c008 100644 |
| --- a/.claude/HANDOFF.md |
| +++ b/.claude/HANDOFF.md |
| @@ -7,31 +7,45 @@ |
| Get Carloku's paid plans live with Stripe Tax and the complete metered model; have the pricing page and signup flow reviewable in the morning. |
| **STATUS:** |
| -Three things, kept apart. (1) Draft copy to review, not approved: pricing http://docs-t1.tail5fd3ba.ts.net:38009 (fallback http://100.119.180.57:38009), console billing page http://docs-t1.tail5fd3ba.ts.net:45033 (fallback http://100.119.180.57:45033). (2) A demo to click through: http://100.119.180.57:41881, real console handlers with Keymail and Stripe simulated; not Stripe proof. (3) A tested branch that is not production-ready: `implementation/carloku-paid-launch/OUTSTANDING.md` says what is reviewable, tested and proven, lists every launch blocker, and lists each approval to ask for with its exact scope. All three review servers answered 200 on the IP form at 07:55 Dublin on 2026-10-01. |
| +Written 09:10 Dublin on 2026-10-01. Three things, kept apart. |
| + |
| +1. Draft copy to review, not approved: pricing http://100.119.180.57:38009 (name form http://docs-t1.tail5fd3ba.ts.net:38009), console billing page http://100.119.180.57:45033 (name form http://docs-t1.tail5fd3ba.ts.net:45033). |
| +2. A demo to click through: http://100.119.180.57:41881, real console handlers with Keymail and Stripe simulated. It is not Stripe proof. |
| +3. A tested branch that is not production-ready. `implementation/carloku-paid-launch/OUTSTANDING.md` says what is reviewable, tested and proven, lists every launch blocker, and lists each approval to ask for with its exact scope. |
| + |
| +All three review servers answered 200 on the IP form at 09:03 Dublin. |
| + |
| +Preview readiness with billing off is not launch readiness. Full metering is not ready: neither metered source is proven (replication writes, store transfer), Stripe has no catalog or runtime key and the quantity fence is unverified, and quantity reduction at renewal and the Free tier are not built. |
| Billing is OFF, the quantity worker is OFF (two switches, both unset), nothing attests, nothing was deployed, and no live Stripe or AWS write was made. |
| -Code tip `d0a21aa1` (it changes code: round twelve's fixes, in `internal/objstore`, `internal/console/apiscan.go` and `internal/release/trash.go`). Full gate on that exact commit: go build, go vet, gofmt, `make test` with 61 packages ok (`logs/gate-d0a21aa1.txt` in the run directory); cross builds for darwin, linux arm64 and windows (`logs/cross-d0a21aa1.txt`). Commits after `d0a21aa1` on this branch are documents only unless this file says otherwise; the earlier gated tips were `1395f7bf`, `84311b9f`, `94ca7482`, `3d4104cb`, `c3e87a94` and `43383b93`. On `1395f7bf` the gate's first run failed one test in `internal/activator`, a package that commit does not touch (`TestExecBackendStartWorkerEnvWinsOverTenantFile`, which reads a file a child process is still writing); it passed 30 runs alone and the second full run passed; both logs are kept. |
| +Code tip when this was written: `abc9f781`. This file does not claim what later commits contain; read `git log abc9f781..` for that. On `abc9f781`: |
| + |
| +- Local gate: go build, go vet, gofmt, `make test` with 61 packages ok (`logs/gate-abc9f781.txt` in the run directory); cross builds for darwin, linux arm64 and windows (`logs/cross-abc9f781.txt`). |
| +- Amadan CI: running when this was written. `run.json` in the run directory, or `amadan ci status carlos/platform -branch feat/carloku-paid-launch-20260916`, has the result. CI sat queued all night, first ran at 07:34 Dublin, and has passed on `1395f7bf`, `d0a21aa1`, `d5705a63` and `973a9f15`. The local gate is not offered in CI's place. |
| +- Review: not confirmed. Round sixteen of both reviewers was started against `abc9f781` at 09:04 (run directory `logs/astra-review16.md`, `logs/opus-review16.md`). |
| -Amadan CI sat queued on every tip all night. It first ran at 07:34 Dublin on 2026-10-01 and has passed on `1395f7bf` and on `d0a21aa1`. Later code tips need their own run; the local gate is not offered in CI's place. |
| +Earlier gated tips: `973a9f15`, `d5705a63`, `d0a21aa1`, `1395f7bf`, `84311b9f`, `94ca7482`, `3d4104cb`, `c3e87a94`, `43383b93`. On `1395f7bf` the gate's first run failed one test in `internal/activator`, a package that commit does not touch (`TestExecBackendStartWorkerEnvWinsOverTenantFile`, which reads a file a child process is still writing); it passed 30 runs alone and the second full run passed; both logs are kept. |
| -Independent review: no round has passed. GPT-6 Astra rejected rounds 1 to 12; the AGENTS-required Opus production review accepted with fixes in rounds 2 to 12. Round twelve (Astra one P1, two P2; Opus one P2, three P3) is fixed in `d0a21aa1` with reproductions and mutation checks, except what `OUTSTANDING.md` names as open (19g). Those fixes have had no independent confirmation: round thirteen of both runs against `d0a21aa1`, run directory `logs/astra-review13.md` and `logs/opus-review13.md`. Nothing lands until a round passes. Dispositions: `docs/superpowers/specs/CODEX-DISPOSITIONS-carloku-paid-launch-overnight.md`. |
| +Independent review: no round has passed. GPT-6 Astra rejected rounds 1 to 15; the AGENTS-required Opus production review accepted with fixes in rounds 2 to 15. Each round found the round before closed for its reported shapes and found neighbouring ones, in the object-store walks (`internal/objstore`) since round seven. Round fifteen's findings (Astra one P1, one P2; Opus one P2, two P3) are fixed in `abc9f781` with reproductions and mutation checks, except what `OUTSTANDING.md` names as open (19a to 19h). Nothing lands until a round passes. Dispositions, round by round: `docs/superpowers/specs/CODEX-DISPOSITIONS-carloku-paid-launch-overnight.md`. |
| -Two open defects, both with their paths disabled, neither offered as a risk to accept: a quantity request that runs after Stripe has forgotten its key, and a late invoice-line request that can leave a finalized invoice with a wrong total a customer could pay. The design that removes both is `docs/superpowers/plans/2026-10-01-late-request-fencing.md`, built so far on `feat/carloku-late-request-fencing-20261001` (`68f77faf`, pushed, not gated, not reviewed). That branch also voids a wrong-total invoice; that is remediation, and its limits are pinned by tests there. |
| +Two open defects, both with their paths disabled, neither offered as a risk to accept: a quantity request that runs after Stripe has forgotten its key, and a late invoice-line request that can leave a finalized invoice with a wrong total a customer could pay. The design that removes both is `docs/superpowers/plans/2026-10-01-late-request-fencing.md`. |
| -Scoped replication attestation (path A) cannot prove an exclusive writer and is off this branch, parked on `feat/carloku-scoped-attestation-20261001` (pushed). Replication-write completeness is a launch blocker, not waived. Path B has a first build on `feat/carloku-metered-replicator-20261001` (`2140eb7b`, pushed, not gated, not reviewed): a metered replication store with no unmetered fallback, an owner for every database the box replicates, and a fleet store that refuses anything it cannot meter. Nothing calls it and nothing attests. Its code map is in the run directory, `notes/path-b-replicator-code-map.md`. |
| +Side branches, all on the forge, each with the full local gate passing on the named tip (base `d5705a63`), none reviewed, none run through CI, nothing on the launch branch calls them: |
| -The operator evidence door for a store's partial first hour has a first build on `feat/carloku-bucket-hour-evidence-20261001` (`457c8da3`, rebased on `d0a21aa1`; the full local gate passes on it, `logs/gate-evidence-457c8da3.txt`; not reviewed, no CI run). The hour still holds by default; the door releases only that hour, only for the owner the ledger names, on a named person's recorded evidence. |
| +- `feat/carloku-late-request-fencing-20261001` (`1772e840`): a Stripe request cannot outlive its connection. It also voids a wrong-total invoice; that is remediation, and its limits are pinned by tests there. The gate caught, and a commit fixed, a timeout the new transport reported as a network fault. |
| +- `feat/carloku-metered-replicator-20261001` (`ebab1a37`): path B, first build. A metered replication store with no unmetered fallback, an owner for every database the box replicates, a fleet store that refuses anything it cannot meter. Nothing attests. Code map: run directory `notes/path-b-replicator-code-map.md`. |
| +- `feat/carloku-bucket-hour-evidence-20261001` (`58c1870c`): the operator evidence door for a store's partial first hour. The hour still holds by default; the door releases only that hour, only for the owner the ledger names, on a named person's recorded evidence. |
| +- `feat/carloku-scoped-attestation-20261001` (`058ea506`): path A, parked. It cannot prove an exclusive writer. Replication-write completeness is a launch blocker, not waived. |
| **NEEDED:** |
| -- Paul: approve or edit both copy reviews; confirm the HALF code word; decide the proration policy; approve or change the whole-paid-day rule for partial months; review member copy for the store refusals. No ruling is asked for on a store's first clock hour or a box's first minutes: they hold by default, and what releases one is an operator evidence door (not built), not a waiver. |
| -- Scoped approvals, prepared as plans only: the `rk_live` restricted key and Stripe catalog; the Cost and Usage Report export; Stripe test mode, to run `TestSandboxQuantityFence` and confirm the provider's treatment of a proration date. |
| +- Paul: approve or edit both copy reviews; confirm the HALF code word; decide the proration policy; approve or change the whole-paid-day rule for partial months; review copy for the store refusals (`OUTSTANDING.md` 19g). No ruling is asked for on a store's first clock hour or a box's first minutes: they hold by default, and what releases one is an operator evidence door, not a waiver. |
| +- Scoped approvals, prepared as plans only: Stripe test mode, to run `TestSandboxQuantityFence`; the `rk_live` restricted key and Stripe catalog; the Cost and Usage Report export; one scratch-object write to check S3's conditional delete. Exact scopes are in the approvals table of `OUTSTANDING.md`. |
| **RECOMMENDED:** |
| -- Read round thirteen and the CI result on `d0a21aa1`; fix what they find and re-review the exact tip. |
| -- Finish the late-request design on its branch (the invoice engine's void on a failed verification, the idle measurement in the sandbox test), then review it. |
| -- Then, each on its own branch: path B of the attestation plan, quantity reduction at renewal, the AWS principal inventory and the bucket ownership attestation door, Free-tier enforcement, dormancy and pool accounting (none started). |
| -- Find what moved 1,395 GB out of Ireland to three other regions in September (collector plan). |
| +- Read round sixteen and the CI result on `abc9f781`. Fix what round sixteen finds, gate, and re-review the exact tip. |
| +- Review the three gated side branches, starting with late-request fencing. |
| +- Then, each on its own branch: the agent wiring and restore path for path B, the evidence door for a box's first minutes, quantity reduction at renewal, the AWS principal inventory and the bucket ownership attestation door, Free-tier enforcement, dormancy and pool accounting. |
| **SESSION:** |
| -Not safe to close: three servers are serving on this box (pids and stop file under `/home/paulca/.local/share/carloku-paid-launch-20260930/logs`), and two review processes may still be running. |
| +Not safe to close without a look: three review servers are serving on this box (pids and stop file under `/home/paulca/.local/share/carloku-paid-launch-20260930/logs`), and two review processes may still be running. Scratch left on the box: `~/.cache/tmp/claude-1001/{mutcopy,fencing-wt,replicator-wt,evidence-wt}` (the last three are git worktrees), `/tmp/k`, `~/.cache/carloku-gate`. |