carlos / platform Public

Reviewed dad9bdb7 read-only. No builds or tests run.

1. P1 — Confirmation objects do not authenticate their producer. Task 4, line 2471 CheckConfirmed accepts unsigned JSON whose claimed confirmer matches a roster entry. The proposed IAM grants every box create access across control/box-enrollment/*. A holder of those credentials can copy attempt IDs and confirmer details from the readable roster, invent request IDs and membership results, and obtain an invitation for a valid same-account identity outside the group. A fabricated guard-ready report can then satisfy the remaining field checks. Create-only storage prevents replacement; it does not establish who created the evidence. Authenticate the producer and test forged objects through the complete enrolment pass.

1. P2 — Installing the channel release blocks subsequent automatic updates. Task 3, line 1703 Bootstrap sets /data ownership before install-channel runs. The installer then creates /data/system/router/<version> as root with mode 0755, and cleanup removes only <version>. The remaining root-owned parents prevent the User=carlos agent from downloading another version or writing requested.json. Preserve service-account ownership and verify an ordinary agent update after a fresh install.

1. P2 — The label space is too small for permanent enrolment references. Open question 4, line 5634 With 1,600 uniformly distributed labels, the probability of at least one collision reaches 50.9% after 48 lifetime launches, and 95.8% after 100. These count historical launches across the deployment, not concurrent boxes. A collision permanently prevents that instance from joining. Replacement may recover capacity, but the spec explicitly identifies a first-build case where a target group with no previously healthy target does not replace unhealthy instances. This is a 2b reliability issue. Use collision-resistant references before enabling automatic replacement.

1. P2 — Concurrent seeding can overwrite shared secrets. Task 2, line 957 Two seed commands can both observe a missing shared parameter, then write different values. Set always uses Overwrite: true, so the second silently replaces the first, violating the promised protection for shared release and secrets keys. Give shared parameters a create-only operation; on conflict, reread and require equality. Regional writes can retain overwrite behaviour.

1. P2 — The specified boot order invokes a binary before obtaining it. 2c’s seams, line 5618 A fresh box runs carlos system host-env write before downloading bootstrap/carlos. No earlier step supplies that executable. Following this sequence stops at configuration. Download and checksum-verify the bootstrap executable first, then use it to assemble host.env before installing the channel release.

1. P2 — The new console signing path escapes the authority census. Task 5, line 3497 newAutoEnroller transfers the console’s directory and root signer into a new controller; runEnrollPass invokes its mutation-capable Pass. Neither is selected by the console census. Consequently, removing or duplicating this authority path would leave that census green. “Calls no selected method” identifies a coverage gap. Add explicit coverage for construction and invocation, alongside the proposed root-read rows.

1. P3 — Unreadable confirmation evidence is treated as invalid evidence. Task 5, line 3286 Every CheckConfirmed error falls through to attempt expiry and replacement. Its second confirmation read or its fence read can fail transiently, so an unknown result can supersede a valid attempt and increase backoff. This contradicts the stated unknown-and-retry rule. Preserve read failures separately from expired or invalid evidence, and retry without changing the attempt.

1. P3 — Two user-visible strings are missing from the copy record. Task 7, line 4440 Neither new unit’s Description= text has a row, although operators see both through systemd. The gate checks its declared inventory, so these omissions remain invisible. Add both descriptions. The existing 61 rows otherwise seem proportionate to the command refusals, help and documentation.

The normal joining sequence, both-slot installation checks, group-role inheritance and AWS adapter separation are represented. The findings above prevent accepting their surrounding safety and recovery guarantees.

Verdict: not ready to build.