amadan
plan 2a: Astra round 2 committed unedited
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+43
−0
docs/superpowers/plans/CODEX-REVIEW-REGION-HA-2A-2.md+43 −0
diff --git a/docs/superpowers/plans/CODEX-REVIEW-REGION-HA-2A-2.md b/docs/superpowers/plans/CODEX-REVIEW-REGION-HA-2A-2.md| new file mode 100644 |
| index 000000000..b3a5c70b5 |
| --- /dev/null |
| +++ b/docs/superpowers/plans/CODEX-REVIEW-REGION-HA-2A-2.md |
| @@ -0,0 +1,43 @@ |
| +| Round-1 finding | Disposition | |
| +|---|---| |
| +| A1: Registration before capacity refusal | **Closed.** Task 11 chooses before `RegisterStart`, carries the selection forward, and tests refusal through recovery. | |
| +| A2: Missing choosing doors | **Partly closed — P2 remains.** The shared refusal reaches all four doors, but Task 12 leaves the move handler’s earlier placement checks intact. A configured destination with no edges file, or only blank public addresses, still returns **400 without an alert** at [apiinstancemove.go:594](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/console/apiinstancemove.go:594). Test the full HTTP path and route this capacity failure through H27. | |
| +| A3: App-derived region validation | **Closed for both reported scenarios.** Task 11 uses `PlaceableBoxes` and adds HTTP tests for stale boxes and a misconfigured sibling. | |
| +| A4: Move filtering with HA off | **Closed.** `placementChooser` gates the filter on HA; tests cover persisted roles and an unreadable roster. | |
| +| A5: Private dialing with HA off | **Closed.** Task 8 uses the reader’s switch and tests both settings. | |
| +| A6: Restart resets alert limit | **Closed by ruling.** Revised H27 explicitly permits an extra alert after restart. | |
| +| A7: Pending copy exposed | **Closed in the plan.** Built rows must be approved; Tasks 10 and 11 wait for approval. | |
| + |
| +Two new findings: |
| + |
| +1. **P2 — A capacity-refused create can still change its environment’s store.** |
| + Task 11 inserts early selection inside `beginClaimCreate`, but [apiinstances.go:1573](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/console/apiinstances.go:1573) calls `bindEnvironmentCreate` first. If the requested environment has a seed-owned store, [takeSeedStore](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/console/seedenvbind.go:76) clears `Declared.Seed` and writes it back. An explicit-region create can therefore change storage ownership, then return the no-capacity 503. Later seed cleanup leaves that store standing despite no instance having been created. Choose before this mutation, and test that the store bytes remain unchanged after refusal. |
| + |
| +2. **P2 — Capacity metrics can be published to the wrong AWS region.** |
| + [Task 13’s `regionCapacities`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/plans/2026-10-16-region-ha-2a-core.md:6135) takes the destination AWS region from the last edges file naming each placement. The capacity count, however, uses the signed roster. A stale or misconfigured file naming `placement=uk, region=eu-west-1` can therefore redirect the valid UK count away from `eu-west-2`. The intended alarm receives missing data and reports a capacity problem even when eligible boxes exist. Derive the metric destination from the same authoritative region mapping used by the chooser, and test conflicting edges-file metadata. |
| + |
| +Platform-1e’s stated conditions are met by the proposed code on static inspection: private addresses use the configured address source, undergo private-IPv4 and CIDR validation, exclude loopback and link-local addresses, and remain routing data. Writer/source and reader tests cover invalid addresses. `boxRoster` performs only a signed roster read, and both production callers pass the operator gate first. |
| + |
| +The census treatment appears complete for the current proposal: all four authority/legacy units and all four B8 digest changes are covered. The overlay must load last, with coverage hashes, unit digests, fingerprints and seals recomputed after Plan 14 Parts 2 and 3. I did not execute the census checks. |
| + |
| +--- |
| + |
| +**FIRST PROMPT:** |
| +Review plan 2a round 2 at `16939cda`, read-only, without heavy checks. |
| + |
| +**WHAT:** |
| +Check prior findings, census conditions and new defects. |
| + |
| +**STATUS:** |
| +Six findings closed, one partly closed; two new P2 findings. No builds or tests ran. |
| + |
| +**NEEDED:** |
| +Nothing for this review. |
| + |
| +**RECOMMENDED:** |
| +Resolve the three outstanding paths and add the described regression coverage. |
| + |
| +**SESSION:** |
| +Safe to close. HEAD verified; worktree unchanged; no processes started. |
| + |
| +**Verdict: not ready to build.** |
| \ No newline at end of file |