carlos / platform Public

PLAN 1: NOT READY TO BUILD.

Reviewed d09077470019 against fetched origin/main 1c43c2ce82f6, moves spec rev 7.20, claim rev 6.28 at 4ffe8a0d, and all three prior reviews. No fetch, modifications, host access, or tests performed.

1. P1 — Task 4’s target-selection integration is not buildable as written. Plan 1:1166 calls undefined snapshotFor and passes three arguments to eligibleBoxes, which takes seven on main. The correction at line 1267 says to reuse the create door’s verified identities and load inputs, but main has no production caller of either eligibleBoxes or chooseBox—only tests. Moreover, chooseBox has no host argument for the prescribed host-dependent hash, and the supplied moveTargetBox body still selects lexically. Specify the actual snapshot, identity verification, load collection, function signatures, and fixtures within Task 4. Reusing an integration that has not landed does not establish claim independence.

1. P1 — Task 7b consumes moves.Check before Task 11 creates it. Plan 1:2420 exports NextSpawnStrict(host) moves.Check; Check first appears at line 3036. Task 7b cannot pass its commit gate. Move the shared type earlier. Its proposed fake Cgroups also needs an explicit seam: main’s field is concrete *cgroup.Manager, so an arbitrary fake cannot replace it.

1. P1 — Signing still uses a later timestamp than the lease check. Plan 1:1516 specifies signingTime = Clock() after Guarded.Before checks its own clock. A pause between those reads allows a fresh signature after lease expiry. “Two statements apart” does not bound a VM freeze. This contradicts spec §7.3’s explicit requirement to sign with the check’s timestamp. Pass that captured timestamp into the signer. Test a pause across expiry between checking and signing; the current signing test never invokes Guarded.Before.

1. P1 — The generation-source prefix is wrong for valid main claims. Plan 1:3347 constructs h.Location + "g-" + generation + "/". Main’s Claim.Validate requires locations without a trailing slash. A valid location therefore becomes instances/h/<inc>g-cur/, yielding an empty source listing. Main’s genselect.requestLocation explicitly adds the separator first. Normalize the boundary and test with a claim accepted by hostclaim.Update.

1. P1 — The floor does not cover the actual recovery entry points. Plan 1:3250 adds checks inside the new applier. On main, both carlos-system-recover.service:17 and carlos-system-update.service:25 directly execute carlos.prev when an update journal exists. An older .prev runs its own unguarded recovery and never reaches the newly added checks. Cover the unit-level selection before executing .prev; a test calling the new restoreFiles directly cannot prove this requirement.

1. P1 — T7’s materialization cannot run under the production agent’s permissions. Plan 1:2419 stages and points live directly under optDir; Task 11 invokes it from the agent. Main’s edge unit uses ProtectSystem=strict and permits writes only under /data and /run/carlos. Existing materializeHook explicitly uses OnStageBlocked(stageRequester(...)) to relay /opt/carlos writes to root. No equivalent pinned-version, held-row relay is planned, so T7 remains failed on hardened boxes. Task 13’s hourly agent write to <optDir>/moves-floor.json has the same permissions problem. Define and test both paths through the appropriate privileged writer.

1. P2 — Default-off does not preserve the real legacy mirror path. Plan 1:1492 makes ordinary s3Mirror implement VersionedCopier. Consequently, the legacy worker’s existing NewS3Mirror enters the new receipt-required mode even with the switch off. Preserving plain fake mirrors does not preserve this production path. An unversioned destination cannot supply the required version receipt and repeatedly recopies unchanged objects. Make version collection explicitly opt-in for Phase 1. Task 13 also specifies unconditional console-record publication and floor processing without defining their dormant boundary.

1. P2 — The new archive verifier rejects valid archives. Plan 1:2201 hashes the decrypted compressed stream before zstd decoding. Build hashes the uncompressed tar through capWriter at line 2043. The assertion at line 2255 that these are the same bytes is incorrect; the good-archive test remains red. Hash the decoded tar, consume its complete hashed representation, and propagate the sealer’s terminal authentication result. The current verifier also neither checks Manifest.Sealed nor explicitly waits for Open to finish.

1. P2 — Correct implementations still fail the supplied fixtures. Plan 1:1589 omits bucket.AddBucket("data-uk"). After fixing that, main’s leasetest.NewS3Server returns 501 NotImplemented for the ordinary PUTs this test sends; it supports create-only PUTs. The R3 fixture defect therefore remains. Separately, Plan 1:1020 instructs writeServingClaim to use a trailing-slash location, which real claim validation rejects. Extend the HTTP fixture deliberately and build claims through valid main primitives.

1. P2 — Task 9 still misstates the flat spawn environment, and its positive test fails. Plan 1:2858 equates flat control availability with b.Control != nil. On main, Control is the nested root-control client; flat startChild independently calls edge.ListenControl. Also, CompareEnv(..., true) now requires both layout variables, although main omits CARLOS_PURGE when Cache == nil. The passing example at line 2628 omits CARLOS_PURGE and therefore fails the proposed implementation. Represent the actual per-variable availability and correct the fixtures.

1. P2 — S1 can pass without reaching or waking the source process. Plan 1:2957 probes through the ordinary edge. Main’s edge.go:1651–1663 serves cached GET responses before invoking the activator. A cached 200 can certify a source that cannot wake, violating S1’s “from its own process” requirement. Task 14 instead describes direct socket dialing, which cannot wake a sleeping instance. Define one wake-and-probe path that bypasses cache and test a cached success beside a failing wake.

1. P2 — The readiness input versions lack concrete producers. Plan 1:2418 requires RenderHeld.BundleETags while using main’s LoadMergedHost, which returns only the merged manifest and instance-overlay ETag; LoadMerged discards the bundle ETags. Add a loader returning the exact bytes and versions used in rendering—later independent reads would not establish that association. Likewise, Task 11 says archive reads use versions named by the source report, but its SourceReport:3054 has only FilesPlain; the archive versions remain in the source-only ledger. Specify their publication.

1. P2 — The private-storage refusal checks a creation policy instead of the instance’s binding. Plan 1:1146 checks Manifest.PrivateStorage. On main this is a mutable create-time policy; disabling it does not remove existing instances’ environment stores. Those instances would pass this check, contrary to §7.1. Both manifest reads also silently bypass their refusals on errors. Inspect the actual environment binding, fail closed on unreadable required policy, and specify the corresponding worker recheck.

1. P2 — Task 15’s pinned inventory rejects the current copy record. Plan 1:3372 inventories M-C1 through M-C20 and rejects unexpected IDs. The reviewed record already contains M-C21 and M-C22 at lines 36–37. Update the inventory and explicitly carry the record into the implementation branch; it is absent from origin/main.

1. P3 — The index and task instructions still contradict the accepted compatibility rule. Index D9:158 still replaces MoveRequest in Plan 1 and deletes staging-wins in Plan 2, contrary to D13. Task 2’s file list and commit text retain those obsolete instructions. Task 14:3348 still names unguarded MovePromoteReady/MoveMarkCutting, despite requiring guarded variants immediately above. Remove these competing implementation directions.

The task-by-task assessment is:

| Task | Main interfaces, prerequisites, and tests | |---|---| | 0 — Switch | New types are straightforward. Actual console environment wiring is in cmd/console/main.go, not server.go. The supplied test covers parsing, not that wiring. | | 1 — IDs | Self-contained new functions; meaningful positive and negative assertions. No blocker found. | | 2 — Journal | Main APIs exist; retaining legacy transitions fixes the previous deleted-consumer problem. New guard tests are meaningful. Stale replacement instructions remain. | | 3 — Claim transitions | StartGuard, RequireOp, kinds, fields and union exist. Renamed fixture avoids the previous collision. Direct fixture tests bypass real claim validation. | | 4 — Door | Blocked by selection integration and invalid claim fixture; refusal coverage is incomplete. | | 5 — Version receipts | Main mirror/receipt interfaces match. Version tests are useful, but plain-fake coverage misses the changed legacy S3 path. | | 6 — Lease/signing | acquireTTL, SafeUntil and the pinned SigV4 signer exist. Timestamp contract and HTTP fixture remain defective. | | 7 — Archive | Crypto signatures match main. Positive verification fails; round-trip, tamper and mode tests otherwise target relevant behavior. | | 7b — Held helpers/strict spawn | LoadMergedHost, ensureStaged, PrepareStrict exist; main already has release.PointLive. Forward type dependency, version provenance, mock seam and root relay need correction. | | 8 — Timers | Main timer fields match. Digest and registration round-trip tests are meaningful. No blocker found. | | 9 — Environment | Spawn-composition helpers exist. Proposed availability rule and test expectations disagree. execBackendFixture is also a placeholder, not an existing helper. | | 10 — Budget | Referenced model exists at 9c417aaa; porting it creates the required code. Arithmetic and expected examples align. | | 11 — Readiness | Pure dependencies exist by this task. Freshness/refusal tests are meaningful; host implementation is explicitly deferred to Task 14. Integration requirements above remain unresolved. | | 12 — Holds | Registry APIs and openTestRegistry exist. Conditional hold tests and the specified negative deletion test are appropriate. | | 13 — Floor | Applier interfaces exist. Actual recovery entry points, privileged persistence and dormant behavior are not covered by the proposed tests. | | 14 — Integration | Main worker and harness exist. Prefix selection, readiness integration and conflicting instructions prevent completion as specified. | | 15 — Copy gate | DefaultEnabled now has an earlier producer. Inventory and implementation-branch record are unresolved. | | 16 — Final gate | Cannot pass the preceding tasks as written. No gate was run during this review. |

Claim dependency conclusion: No direct Plan 1 import or call into unmerged hostops, hostbox, hostwrite, hostexec, hostfence, or hostquarantine was found. However, Task 4 assumes nonexistent production selection wiring. The plan must specify a complete adapter using merged primitives or declare its dependency. Claimless-host refusal pending C5 adoption is already explicit and is not itself a build blocker.

Import/identifier conclusion: No new package import cycle or duplicate top-level identifier was found in the intended additions. The concrete build failures are missing integration symbols and task ordering. Main is not demonstrably shippable after every task, and the default-off legacy contract remains broken by Task 5.

---

FIRST PROMPT: Focused read-only review of moves Phase 1 Plan 1 and its index.

WHAT: Check buildability, claim independence, dormant behavior, tests and spec coverage.

STATUS: Review complete. PLAN 1: NOT READY TO BUILD.

NEEDED: Nothing for this review.

RECOMMENDED: Resolve the findings, reconcile the task instructions, then repeat the focused review.

SESSION: Safe to close. Repository unchanged; nothing started; no handoff file written.