| 1 | # Census overlay pro-6214-service-runs-decisions, written BY HAND (AGENTS.md, The census: census-propose refuses decisions). The decisions of census-ruling-pro-6214-service-runs (Linear PRO-6214: run-role service credentials, keyed run create; docs/superpowers/specs/2026-10-24-service-runs-design.md): five new units and one removed. Loaded from the chain manifest before plan14-root-reads-pro-6214-service-runs.tsv, which census-propose wrote for the approvals. Asked of the census owner on #280 with the card docs/superpowers/notes/census-proposal-pro-6214-service-runs.md; rows carry the ruling from the start (#369). |
| 2 | # No root read is added. The console units run as carlos-console, and the root carlos binary links neither internal/console nor internal/mail (TestRootBinaryLinksNoConsoleOrMail); the CLI units run in carlos run as its caller. Each new unit is accepted legacy at the class of the row it mirrors, named in its basis. Five frozen declarations are added, so the seal moves. |
| 3 | # NEW, authority (the run doors): the keyed-create lookup door, GET .../instances/{host}/runs?key=<key>. Mirrors handleAPIRunGet (census-ruling-carlos-run): the run doors' gate, then a read. |
| 4 | @legacy b8dd3663d5257adc761ba2ae1812580d54515444f35e854c3e687e7c48e7b03b internal/console/apiruns.go Server.handleAPIRunKeyLookup legacy accepted-legacy accepted-legacy;rev3=census-ruling-pro-6214-service-runs;identity=the console (cmd/console serve under console.service, user carlos-console);basis=new: GET .../instances/{host}/runs?key=<key>, registered with svcrole.Exactly(Run) (a person on the member rule, or a run service; Admin does not join): runCaller, the shared gate, the host-claim refusal and the runs budget, then the instance record from the deployment bucket and the run id its run_keys holds for runs.ScopedKey(caller scope, key), or 404; a key is stored scoped to its caller and hashed, so another caller's key is never found; its one scanned site is r.URL.Query() of the request URL (the key), not a file, as handleAPIRunGet's after; it writes nothing; the class of handleAPIRunGet (census-ruling-carlos-run) file:Query@528 635e57ad13d3468fdacc021543d52c36d1c1867a46f828665e2e0f657271076e |
| 5 | internal/console/apiruns.go Server.handleAPIRunKeyLookup legacy accepted-legacy accepted-legacy;rev3=census-ruling-pro-6214-service-runs;identity=the console (cmd/console serve under console.service, user carlos-console);basis=new: GET .../instances/{host}/runs?key=<key>, registered with svcrole.Exactly(Run) (a person on the member rule, or a run service; Admin does not join): runCaller, the shared gate, the host-claim refusal and the runs budget, then the instance record from the deployment bucket and the run id its run_keys holds for runs.ScopedKey(caller scope, key), or 404; a key is stored scoped to its caller and hashed, so another caller's key is never found; its one scanned site is r.URL.Query() of the request URL (the key), not a file, as handleAPIRunGet's after; it writes nothing; the class of handleAPIRunGet (census-ruling-carlos-run) file:Query@528 635e57ad13d3468fdacc021543d52c36d1c1867a46f828665e2e0f657271076e |
| 6 | # NEW at J4: console SQL on its own database, as migrateCLIAuth. |
| 7 | @legacy f28f3445ca3a2b61534ec796b72df7b2647e072ee300eefe57cc68ca27745436 internal/console/authstore.go Store.backfillCredentialIDs legacy accepted-legacy accepted-legacy;rev3=census-ruling-pro-6214-service-runs;identity=the console (cmd/console serve under console.service, user carlos-console);basis=new: runs at every console Open, from migrateCLIAuth: one Query of the console's own cli_tokens (CONSOLE_DB, SQLite) for service and legacy app rows whose credential_id is empty, then one Exec per row setting a fresh newCredentialID only WHERE credential_id is still empty, so an id once given is never replaced and a second run changes nothing; a person's row keeps ''; the class of migrateCLIAuth (J4 root-input) file:Exec@554,file:Query@62 3fbb21eca5b07c5278e86ee25d70dcd570cced18514f3d7af6666dc2d85748b5 |
| 8 | internal/console/authstore.go Store.backfillCredentialIDs legacy accepted-legacy accepted-legacy;rev3=census-ruling-pro-6214-service-runs;identity=the console (cmd/console serve under console.service, user carlos-console);basis=new: runs at every console Open, from migrateCLIAuth: one Query of the console's own cli_tokens (CONSOLE_DB, SQLite) for service and legacy app rows whose credential_id is empty, then one Exec per row setting a fresh newCredentialID only WHERE credential_id is still empty, so an id once given is never replaced and a second run changes nothing; a person's row keeps ''; the class of migrateCLIAuth (J4 root-input) file:Exec@554,file:Query@62 3fbb21eca5b07c5278e86ee25d70dcd570cced18514f3d7af6666dc2d85748b5 |
| 9 | # NEW at J4: crypto/rand, as newStore (email-signin) and Keymail.sealEnvelope (console-invite-delivery). |
| 10 | @legacy c899e2382f8efc86faa20bd8e3bb80939cb79a3ef5ef4901698aa4990c792588 internal/console/authstore.go newCredentialID legacy accepted-legacy accepted-legacy;rev3=census-ruling-pro-6214-service-runs;identity=the console (cmd/console serve under console.service, user carlos-console);basis=new: one crypto/rand.Read of 16 bytes from the kernel's random source, hex-encoded: a service credential's stable identity, not a secret, never derived from its name; no file, no store, no box state; the class of newStore's crypto/rand reads (email-signin) and Keymail.sealEnvelope's (census-ruling-console-invite-delivery) file:Read@78 570490418b8acb1cf1ff543f9db2a226bb42e8d1ba458456b0a3fd7ba3780cb5 |
| 11 | internal/console/authstore.go newCredentialID legacy accepted-legacy accepted-legacy;rev3=census-ruling-pro-6214-service-runs;identity=the console (cmd/console serve under console.service, user carlos-console);basis=new: one crypto/rand.Read of 16 bytes from the kernel's random source, hex-encoded: a service credential's stable identity, not a secret, never derived from its name; no file, no store, no box state; the class of newStore's crypto/rand reads (email-signin) and Keymail.sealEnvelope's (census-ruling-console-invite-delivery) file:Read@78 570490418b8acb1cf1ff543f9db2a226bb42e8d1ba458456b0a3fd7ba3780cb5 |
| 12 | # NEW: hashes a --file the caller named, as runMetaFor stats it. |
| 13 | @legacy 728ed7b2a43ca78f5235e4e2f47d056b93313d949b171b8f44926c485ed7e9b9 run.go runFileSum legacy accepted-legacy accepted-legacy;rev3=census-ruling-pro-6214-service-runs;identity=the carlos CLI on the caller's own machine, as that caller: a person, or a server holding a run credential as CARLOS_SERVICE_TOKEN; no box unit runs carlos run;basis=new: opens a --file path the caller named on their own command line, which runMetaFor has just stat'ed as a regular file, and hashes it to EOF; nothing else is opened; reached only with --idempotency-key; the class of runMetaFor (census-ruling-carlos-run) file:Open@58 745fa0d005c295604b2ebc35f6293e41f761e9add6092f5341be051cd7fa6991 |
| 14 | run.go runFileSum legacy accepted-legacy accepted-legacy;rev3=census-ruling-pro-6214-service-runs;identity=the carlos CLI on the caller's own machine, as that caller: a person, or a server holding a run credential as CARLOS_SERVICE_TOKEN; no box unit runs carlos run;basis=new: opens a --file path the caller named on their own command line, which runMetaFor has just stat'ed as a regular file, and hashes it to EOF; nothing else is opened; reached only with --idempotency-key; the class of runMetaFor (census-ruling-carlos-run) file:Open@58 745fa0d005c295604b2ebc35f6293e41f761e9add6092f5341be051cd7fa6991 |
| 15 | # NEW at J4: doMultipartMethod's body moved here with extra request headers. |
| 16 | @legacy 59a2b392040051489bdc0975160d4e53435d47e35da02710a1ccd2cf558759d6 auth.go consoleClient.doMultipartHeaders legacy accepted-legacy accepted-legacy;rev3=census-ruling-pro-6214-service-runs;identity=the carlos CLI on the caller's own machine, as that caller: a person, or a server holding a run credential as CARLOS_SERVICE_TOKEN; no box unit runs carlos run;basis=new: consoleClient.doMultipartMethod's body moved here unchanged, plus caller-supplied request headers (a run's Idempotency-Key), set before the content type and the bearer, which they cannot override; its one site, io.ReadAll of the console's response body, is doMultipartMethod's, J4 root-input as that row was file:ReadAll@1418 4682be879f99a1ede5b839198dd1568973b06cdbd0d911b0a95f821e1437c17b |
| 17 | auth.go consoleClient.doMultipartHeaders legacy accepted-legacy accepted-legacy;rev3=census-ruling-pro-6214-service-runs;identity=the carlos CLI on the caller's own machine, as that caller: a person, or a server holding a run credential as CARLOS_SERVICE_TOKEN; no box unit runs carlos run;basis=new: consoleClient.doMultipartMethod's body moved here unchanged, plus caller-supplied request headers (a run's Idempotency-Key), set before the content type and the bearer, which they cannot override; its one site, io.ReadAll of the console's response body, is doMultipartMethod's, J4 root-input as that row was file:ReadAll@1418 4682be879f99a1ede5b839198dd1568973b06cdbd0d911b0a95f821e1437c17b |
| 18 | # Removed: still declared, and reads nothing now. Retired by an H3 census-ruling removal (zddr3's form; the loader takes H3 only with a census-ruling- basis). A removal is not in the seal. |
| 19 | @remove auth.go consoleClient.doMultipartMethod |
| 20 | @removed auth.go consoleClient.doMultipartMethod H3 census-ruling-pro-6214-service-runs: still declared, and reads nothing now: its body and its one site, io.ReadAll of the console's response body, moved unchanged into consoleClient.doMultipartHeaders, an accepted-legacy row in this overlay, which it calls with no extra headers. It runs in the carlos CLI as its caller. |
| 21 | |
amadan