amadan
docs: per-session canary rule — test-*.11ch.at, pinned, session-owned, torn down (#436)
Parallel Claude sessions were sharing (and trampling) the test instance; today's channel sweep also stomped two sessions' pinned canaries. Now that wildcard DNS + the wildcard cert make instances free to mint, each session gets its own test-<slug>.11ch.at canary: pinned (never auto-updates), updated only by its session, torn down when the work merges. Fleet-wide operations check update status for AUTO=pinned rows first.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
1 file changed,
+27
−0
CLAUDE.md+27 −0
diff --git a/CLAUDE.md b/CLAUDE.md| index 689032b..4ca584d 100644 |
| --- a/CLAUDE.md |
| +++ b/CLAUDE.md |
| @@ -390,6 +390,33 @@ Principles that hold regardless of environment: |
| overridden by the platform). |
| - Keep a **throwaway instance** for verifying on real devices. |
| +### 🤖 Per-session canaries (test-*.11ch.at) |
| + |
| +Instances are disposable — wildcard DNS **and** a wildcard TLS cert cover |
| +`*.11ch.at`, so creating one needs no DNS step, no cert wait, and burns no |
| +rate limit. So instead of sharing one `test` instance across parallel |
| +sessions (they trample each other): |
| + |
| +- **Every Claude session doing server work creates its own canary**: |
| + `lchat add-instance test-<slug>.11ch.at` on the router box (box specifics |
| + in `CLAUDE.local.md`), slug = your branch/feature. The `test-` prefix keeps |
| + canaries visually distinct from real member spaces (short sqid subdomains). |
| +- **A canary never auto-updates — pin it.** Deploy branch builds with |
| + `lchat deploy test-<slug>.11ch.at --version <ver> --pin`; the hourly |
| + auto-updater leaves pinned instances alone, and `lchat update status` shows |
| + them as `AUTO=pinned`. The session owns its canary's version for its whole |
| + life (`lchat rollback` / re-deploy as you iterate). |
| +- **The session tears its canary down** when the work merges: |
| + `lchat remove test-<slug>.11ch.at --stop`, then delete |
| + `/data/test-<slug>.11ch.at.*` (removal alone never deletes data — that's |
| + deliberate for real instances; a canary's data is yours to destroy). If you |
| + added a bot sidecar, disable `lchat-bot@test-<slug>.11ch.at` too. |
| +- Canaries hold **no real member data** and their admin tokens are **not** |
| + stored in 1Password — everything about them dies with the session. |
| +- Corollary for fleet-wide operations (channel changes, unpin sweeps, |
| + `deploy --all`): check `lchat update status` first — every `AUTO=pinned` |
| + row is someone's live canary; leave it alone. |
| + |
| ## Branches, commits & PRs |
| - **Prefer small, focused PRs that ship incrementally.** When iterating, slice |