carlos / platform Public

A4-1 is partially closed: the required gate is now stated, but raising the existing floor is unsupported. A4-2’s current/previous mismatch is closed, but the specified rotation exposes another failure.

1. P2 — The existing host floor cannot be raised as specified. Spec:233

Once claim mode has published its floor, changing min_release changes its digest. Disk.Persist:73 rejects that change; PublishFloor:35 also refuses it, and the bucket objects are create-only.

Failure scenario: an enrolled deployment upgrades every box to forwarding v2, then attempts stage 2. Its existing guards cannot adopt the higher floor, so the required census reports never appear. Overwriting only the bucket floor would instead trigger local/remote digest refusals.

Specify an authenticated, monotonic floor transition covering guards, roster, census and recovery—or a separate forwarding floor. Test migration from an already-published claim floor.

1. P2 — Immediate .next signing causes failures during staggered refresh. Spec:227

The existing code explicitly documents this propagation window at mesh.go:52. Dual acceptance helps only after the receiver has loaded .next; waiting before promotion does not prevent early signing.

Failure scenario: box A refreshes first and signs with .next. The destination NLB selects box B, which still knows only the current key; the host lives on box C. B rejects authentication and, under the new refusal rule, returns 503 instead of forwarding to C. This contradicts the staggered-refresh test requirement.

Separate distributing the verification key from activating it for signing, with receiver readiness established before activation. Preserve the prohibition on forwarding failed credentials.

Reviewed platform 3b721bfde90c461bcf62092e25b464d6cf1fdcf4 and flagship 7c99ff8f1512f1a9ff3bf13337c3d147d730a6b6. No files changed; no builds, tests or infrastructure commands run.

---

FIRST PROMPT: Review spec 2 round 5 at the pinned HEAD, read-only, against flagship Tofu.

WHAT: Confirm A4-1/A4-2 and report new findings.

STATUS: Complete; two P2 findings.

NEEDED: Nothing.

RECOMMENDED: Define the floor transition and safe key-signing activation before planning.

SESSION: Safe to close; nothing started or modified.

Verdict: not ready for a plan.