carlos / platform Public

| Prior finding | Disposition at 0236be94 | |---|---| | R4-1 | Resolved for the reported failure. Removing the root-peer rejection preserves systemd-created application listeners. The replacement path restriction introduces R5-1 below. | | R4-2 | Resolved. The raw directory and confined directory-fd renames provide endpoints on one mount. The changed storage location introduces the downgrade defect in R5-2. | | R4-3 | Resolved. Custom paths are excluded from migration; the remaining forward sources follow their existing file contracts. | | R4-4 | Resolved. The probe no longer requires a forbidden netlink route query. | | R2-4 | Partially resolved. The seed-record outcome rule is now explicit. However, start --no-block followed by show does not retain invocation identity. --no-block only enqueues the job: the subsequent query can precede activation or follow completion and unloading. “Immediately” supplies no synchronization. Retain the unit through completion and result capture, or provide equivalent request-to-invocation correlation. systemctl semantics, unit garbage collection. | | R2-5 | Resolved. Foreign invocations are stopped, and completion still requires terminal state and an empty cgroup. Unproven stops retain replication and the lease. | | R2-7 | Partially resolved. Forward recovery now recognizes both row endpoints and changed fleet intent. But the new validation requires from to be flat even for a reverse journal. A legitimate nested→flat transaction therefore fails validation. Derive both endpoints from the journal’s direction, including artifact sources. Also reconcile §3.3’s remaining requirement that journal direction equal current fleet intent with §8.2’s explicit opposite rule. | | R2-9 | Resolved for the original first-upgrade defect. Flat minting preserves compatibility before migration. The newly introduced mount-removal defect is R5-2. | | R2-14 | Resolved at spec level. IPv6 evidence remains explicitly unverified when unavailable; the exception has a five-minute bound, rechecks and status reporting. | | R1-4 | Resolved. Completion is independent of log EOF, blocking observations stay outside the mutex, and the foreign-invocation completion exception is removed. | | R1-5 | Partially resolved. Preparation, execution budget, cancellation and termination-before-cleanup are specified. Seed invocation correlation remains defective under R2-4. | | R1-8 | Resolved. Shared tier limits and the deliberate per-service OOM-family difference are specified. | | R1-12 | Partially resolved. Consumer fences are specified; reverse-journal recovery remains defective under R2-7. | | R1-13 | Partially resolved. Explicit reversal and collision refusal replace the original history-selection defect, but reverse validation remains inconsistent under R2-7. | | R1-15 | Resolved at spec level. There is no unsafe PID-namespace fallback; the probe and bounded IPv6 exception are specified. | | R1-18 | Resolved under the recorded ruling. Remote reporting and layout operations are specified. The box-local foreign repair residual is explicitly accepted. |

R5-1 — P2 — §§5.4, 6.1, 8.3: Retain the authenticated control service, but preserve supported custom socket paths.

The new rule rejects every application dial outside /run/carlos/. An existing route with Socket=/run/titogo/example.sock therefore loses public traffic and health checks on upgrade, even though §8.3 promises that foreign routes keep running unchanged.

The existing CLI accepts an explicit socket pathname, and the edge uses it without this directory restriction. The reviewed Tito precedent itself binds beneath /run/titogo.

Evidence: new dial restriction, compatibility promise, CLI socket input, edge dispatch.

Correction: retain process authentication and the actual-peer-address check. Reserve and reject the broker endpoint explicitly while permitting existing ordinary upstream paths. Verify a legitimate custom socket outside /run/carlos/ alongside direct and symlinked attempts to proxy to the broker.

R5-2 — P2 — §§3.2, 8.2, 9: Removing the new bind mounts invalidates the downgrade recovery claim.

This revision stores the database physically under /data/.instances and exposes it through /data/instances. An ordinary downgrade to a pre-layout release removes the new mount units: installUnits executes systemctl disable --now for every removed unit before deleting its file.

Consequently, the old backend’s nested DBPath no longer reaches the database. The same change removes the nested runtime-directory view immediately, rather than only after reboot as §8.2 claims.

There is also a second-copy path: the old backend sees the database as absent and invokes restore. Litestream creates missing parent directories, so it can restore into the uncovered /data/instances/<host>/ while the original remains under /data/.instances/<host>/. Reinstalling the bind mount hides that restored copy from the specified collision check.

Evidence: new mount source, downgrade claim, removed-unit handling, missing-database handling, restore directory creation.

Correction: make completed reversal a checked prerequisite for removing these mounts and starting a pre-layout binary. Define recovery for an already-unmounted layout, including checking the uncovered mountpoint before remounting. Verify through the actual updater’s unit-removal path.

R5-3 — P1 — §§3.1, 6.1, 8.2: The longer socket paths make previously working hosts unwakeable after migration.

For a valid 80-byte hostname, the current application socket is 97 bytes and its control socket is 105 bytes. The proposed paths become:

• Application: /run/carlos/instances/<host>/app.sock — 111 bytes.
• Control: the same path plus .control — 119 bytes.
• Sidecar log: /run/carlos/logs/<host>.sidecar.sock — 110 bytes.

Linux’s Unix socket address has a 108-byte pathname field; Go requires room for the terminating NUL. These new addresses cannot bind. Migration nevertheless accepts the flat row and commits the nested paths, after which the application cannot wake.

Evidence: runtime layout, existing hostname validation, Go’s address-length rejection, Linux Unix socket limits.

Correction: specify a bounded per-host runtime identifier consistently across socket paths, unit bind paths and log endpoints. Preflight every resulting Unix socket address before moving files. Include a hostname that fits the current application and control sockets but exceeds the proposed limits.

Verdict: request changes.