oficina / sheets Public

design: keep activation observer free of application dependencies

Paul Campbell pushed by paul@keymail.dev 1 month ago b340a3d83e76e357574608471fa41a6bdfc35f32 parent 1db5481

1 file changed, +1 −1

docs/superpowers/specs/2026-09-07-canary-fixture-bootstrap.md +1 −1

Intent

Attributed to this commit: 14.1 g CO₂e (630698 tokens). This is an attribution, not a measurement — usage counted from this commit's own marker forward to the next one on test/canary-session-fixture, never backward from it. A turn that produced more than one commit books all of its tokens to the last one, and a concurrent session on this branch can add to the same figure. Some of it was priced using the shared default rate, because no model-specific factor row exists yet for at least one model involved. The Carbon view has the repo total, which is never derived from this attribution.

full ledger: test/canary-session-fixture

diff --git a/docs/superpowers/specs/2026-09-07-canary-fixture-bootstrap.md b/docs/superpowers/specs/2026-09-07-canary-fixture-bootstrap.md

index dd90ead..3b87faf 100644

--- a/docs/superpowers/specs/2026-09-07-canary-fixture-bootstrap.md

+++ b/docs/superpowers/specs/2026-09-07-canary-fixture-bootstrap.md

@@ -23,7 +23,7 @@ Use a temporary reviewed bootstrap binary on this isolated instance, then replac

Root has confirmed the named environment supports explicit empty values and configured the synthetic SMTP values below; default app configuration remains untouched. The route API exposes the exact canary socket, channel and environment but not its resolved DB path. A separate preflight-only command closes that evidence gap before a writer is built.

-Build cmd/sheets-fixture-preflight with a clean-tree fixture-preflight-release target and a unique <sha>-fixture-preflight-<runID> stamp. It contains no database-open, migration, seed, socket-listen or filesystem-probing path. It validates the compiled exact origin, synthetic owner, one-use run ID, SMTP settings and key formats against the actual child environment. This catches an unexpected box-local .env override without opening or printing that file or any secret value. A mismatch refuses with a fixed guard code. It parses the activation args, rejects relative/unclean DB paths before Resolve could join them, requires the exact known canary socket and exact canary DB basename, and refuses addr/LISTEN_FDS or other unsupported shapes.

+Build cmd/sheets-fixture-preflight with a clean-tree fixture-preflight-release target and a unique <sha>-fixture-preflight-<runID> stamp. It uses only standard-library dependencies and its own linker-stamped buildVersion, since importing the app/framework would pull database code into the preflight import graph. It parses the documented two-flag exec-child shape itself; the writer still uses rastrillo.Resolve. It contains no database-open, migration, seed, socket-listen or filesystem-probing path. It validates the compiled exact origin, synthetic owner, one-use run ID, SMTP settings and key formats against the actual child environment. This catches an unexpected box-local .env override without opening or printing that file or any secret value. A mismatch refuses with a fixed guard code. It parses the activation args, rejects relative/unclean DB paths before Resolve could join them, requires the exact known canary socket and exact canary DB basename, and refuses addr/LISTEN_FDS or other unsupported shapes.

After these guards pass, report only the preflight stamp, validated canary DB argument and socket argument to the operator log, then exit. No file or socket is opened, no database is materialized, no environment changes, no HTTP route is served, and no app assertion runs. Root reads only this instance's supported logs and records that one observed path. The activation may report unsuccessful readiness because preflight deliberately exits without serving; that expected result is not a failed candidate test. Repeated activation only repeats the same guarded read-only observation.