carlos / platform Public

| Prior finding | Disposition at c5393728 | |---|---| | R10-1 | Resolved for the credential exposure. All tenant roles hide /etc/carlos; §9 extends the audit to credential reads. The new probe setup has a separate defect below. | | R5-2 | Resolved. Downgrade checks every row’s paths regardless of flags and requires completed reversal; unflagging nested rows is refused (§8.2). | | R5-3 | Resolved. Directory, socket, unit and slice names consistently use bounded InstanceID(host) (§§3.1, 5.3). | | R2-4 | Resolved. Blocking seed execution and RemainAfterExit=yes retain invocation identity and results through capture (§§4.2, 5.3). | | R2-5 | Resolved. Completion requires terminal state and cgroup emptiness, including foreign invocations; uncertain stops retain the lease (§§6.3, 6.5). | | R2-7 | Resolved. Recovery derives both endpoints from journal direction, completes that transaction, then converges to current intent (§8.2). | | R2-9 | Resolved. Flat minting, explicit reversal, env asides and completed-reversal downgrade guards cover the reported failures (§§8.1–8.2). | | R2-14 | Resolved at spec level. The IPv6 exception is explicit, bounded, rechecked and reported (§8.5). | | R1-4 | Resolved. Log EOF does not establish termination; blocking observations remain outside the activator mutex (§§6.4–6.7). | | R1-5 | Resolved. Seed preparation, execution budget, cancellation, result retention and termination-before-cleanup are specified (§§6.1–6.5). | | R1-8 | Resolved under the recorded decision. Shared tier limits remain; per-service OOM families are an explicit difference (§4.3). | | R1-12 | Resolved. Named consumer fences and bidirectional journal recovery cover interrupted migration (§8.2). | | R1-13 | Resolved. Reverse recovery and completed-reversal downgrade guards address the reported defects (§8.2). | | R1-15 | Resolved for the reported PID/IMDS defects. No unsafe fallback remains; the behavioural gate is specified (§8.5). | | R1-18 | Resolved under the recorded ruling. Remote operations and reporting are specified; the foreign repair residual remains explicitly accepted (§§8.3–8.4). |

R11-1 — P2 — §§5.2, 8.5: The control service’s sandbox prevents creation of the new probe fixture.

Retain §5.4’s process-authenticated control service.

§8.5 requires the control service to stage /etc/carlos/probe-secret as root:carlos 0640 before running the probe. But the supplied control-service unit sets ProtectSystem=strict without a writable exception for that path. This makes /etc read-only inside the service; ordinary file creation fails with EROFS despite running as root. systemd execution semantics.

On a clean rollout, the mandatory fixture therefore cannot be prepared as specified. Honouring the setup failure prevents readiness; proceeding without the fixture makes its unreadability check vacuous.

Correction: assign fixture creation to root bootstrap/tmpfiles, ordered before the probe. Have the control service verify that the fixture exists with the required ownership and mode before accepting the probe result. Keep /etc/carlos inaccessible in every tenant template.

Verdict: accept with corrections.