carlos / platform Public

Today, claim mode and multi-box regions are AWS-only. A box's identity is AWS's signed instance identity document:

• enrolment requires AWSRegion and verifies AWS-signed evidence (internal/hostactors/enroll.go:29);
• roster validation requires Cloud.Provider == "aws" (internal/hostactors/roster.go:111);
• hosting re-verifies it (internal/hostbox/identity.go:45);
• placement eligibility requires an AWS region and Cloud.Complete() (internal/boxchoice/boxchoice.go:110, internal/boxid/verify.go:30).

A self-hosted deployment without AWS (MinIO bucket, any hosts, DNS) is fine with one box and claim mode off. It can't run several boxes in a region.

Ask: a spec for a provider-neutral box identity, with AWS's identity document as one adapter. For example, an operator-issued key pair per box that the console vouches for at enrolment. It must keep what the AWS identity gives today: unique references, isolation between a box and its replacement, and re-verification at admission.

Region HA spec 2 (two-box regions, design-region-ha-two-box, §25) keeps its own new AWS parts as adapters (SSM config, IMDS addresses, Auto Scaling membership, the NLB), so this spec only has to replace identity. Paul's ruling, 2026-10-16: multi-box stays AWS-only until this lands.

This touches the claim's identity model, so the claim session (platform-1e) is the natural owner or co-owner.