# Astra round 2 brief: instance key provision, plan rev 2

**Review:** `docs/superpowers/plans/2026-10-10-instance-key-provision.md`, rev 2 (f2c8149c), on branch `instance-key-build`. Its disposition table answers your round 1 (`CODEX-PLAN-INSTANCE-KEY-R1.md`): 8 accepted, finding 6 declined, and one acknowledged. The planner's report is `INSTANCE-KEY-PLAN-REPORT-R2.md`. Round 1's brief still applies.

**What changed:**
- **Key-source evidence (O2′).** Relocation accepts one of three sources:
  - (a) `instance.key` in the pinned manifest;
  - (b) the platform key, plus a durable adoption record. The agent writes it when rastrillo's helper calls `PUT /instance-key/adoption` with the key's SHA-256. This call is asked of rastrillo on #66, and is not yet built.
  - (c) a key from the bucket-held config.

  Anything else refuses, as before.
- **Durability.** "Ensure" completes chmod and the file and directory fsyncs every time before it reports success.
- **Other fixes.** Nested backfill opens with mode 0. The decision uses the effective merged environment. The claim-restart premise is corrected and pinned by a test.
- **Finding 6 declined.** The hub's `-squash` is Paul's standing rule; AGENTS.md's text is older.

**Known residuals the planner lists. Judge whether each is acceptable:**
- Claim launches strip `CARLOS_CONTROL_SOCKET` (`claim_snapshot.go:116`), so adoption can't be recorded on claim boxes until they get one (O6).
- Source (c) passes an app that keeps its own unpublished `instance.key` while also having the key set in configuration.
- Moves leave a stale adoption record on the source box.
- Ruling 18 treats fsync as not being a host write, and the claim path syncs outside the guard.

**Judge:**
1. Is each round 1 finding closed?
2. Is O2′ sound? Can any path accept a key the data isn't sealed with? Is the adoption record forgeable by the tenant? It is authenticated with the admin token, which the app holds. Does the record bind to the right host, installation and key?
3. Is the adoption endpoint safe? Consider replicas, a mismatched key (409), and old agents.
4. The residuals above.
5. Anything new.

Give findings as P1/P2/P3 with file:line, then a verdict: ready to build, or not.