carlos / platform Public

branch:

Clone

git clone https://amadan.net/carlos/platform

Plain git — no account needed to clone.

Download

Download this file

1	\| Round-4 finding \| Disposition at `e47d04ee` \|
2	\|---\|---\|
3	\| R4-1 — Resumed rollback deletes a replacement seed \| Fixed. §3.1 scopes snapshots to seed IDs; §5.6 retires the journal before deleting the aborted record, preserving the create-only reservation through cleanup ([provision.go:845](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/run-and-seeded/internal/provision/provision.go:845)). \|
4	\| R4-2 — Move strands an unplaced seed \| Fixed at spec level. §5.8 assigns placement/commit checks to both move doors under the record CAS and to workers before effects. \|
5
6	1. P1 — Seeded §2 ruling 4 and §4: ordinary creation does not guarantee an empty private store.
7
8	Create a canary with `--from <source> --environment <source-environment>`. Section 4 accepts the explicit environment and relies on ordinary creation to provide an empty private store. Existing creation preserves that environment ([apiinstances.go:1096](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/run-and-seeded/internal/console/apiinstances.go:1096)) and provisions storage by account, app and environment, without a host coordinate ([instanceprivatestore.go:250](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/run-and-seeded/internal/console/instanceprivatestore.go:250)). `GrantIn` retains an existing bucket and returns its existing provisioned store ([walk.go:219](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/run-and-seeded/internal/objstore/walk.go:219), [walk.go:289](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/run-and-seeded/internal/objstore/walk.go:289)).
9
10	A plan following §4 therefore gives the canary access to the source’s populated store, violating the fixed empty-store ruling.
11
12	Fix: assign the seed doors a destination environment/store reservation that guarantees a fresh private store. Refuse the source’s per-host environment and existing shared-store bindings; allow reuse only for retries belonging to the same seed. Preserve existing stores and their bindings.
13
14	Seeded instances: revise.
15
16	`carlos run`: accept, carried forward from round 4; not re-reviewed.

1	\| Round-4 finding \| Disposition at `e47d04ee` \|
2	\|---\|---\|
3	\| R4-1 — Resumed rollback deletes a replacement seed \| Fixed. §3.1 scopes snapshots to seed IDs; §5.6 retires the journal before deleting the aborted record, preserving the create-only reservation through cleanup ([provision.go:845](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/run-and-seeded/internal/provision/provision.go:845)). \|
4	\| R4-2 — Move strands an unplaced seed \| Fixed at spec level. §5.8 assigns placement/commit checks to both move doors under the record CAS and to workers before effects. \|
5
6	1. P1 — Seeded §2 ruling 4 and §4: ordinary creation does not guarantee an empty private store.
7
8	Create a canary with `--from <source> --environment <source-environment>`. Section 4 accepts the explicit environment and relies on ordinary creation to provide an empty private store. Existing creation preserves that environment ([apiinstances.go:1096](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/run-and-seeded/internal/console/apiinstances.go:1096)) and provisions storage by account, app and environment, without a host coordinate ([instanceprivatestore.go:250](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/run-and-seeded/internal/console/instanceprivatestore.go:250)). `GrantIn` retains an existing bucket and returns its existing provisioned store ([walk.go:219](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/run-and-seeded/internal/objstore/walk.go:219), [walk.go:289](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/run-and-seeded/internal/objstore/walk.go:289)).
9
10	A plan following §4 therefore gives the canary access to the source’s populated store, violating the fixed empty-store ruling.
11
12	Fix: assign the seed doors a destination environment/store reservation that guarantees a fresh private store. Refuse the source’s per-host environment and existing shared-store bindings; allow reuse only for retries belonging to the same seed. Preserve existing stores and their bindings.
13
14	Seeded instances: revise.
15
16	`carlos run`: accept, carried forward from round 4; not re-reviewed.