amadan
docs: rails-poc spec — record execution deviations
Two things execution did differently from what §2 said, called out right before §7 so they read alongside the rest of the roadmap fallout: box SG ingress admits the IE edge by private IP /32 rather than an SG reference (cross-VPC), and the web port publishes on all interfaces rather than the private IP only (exposure is nil — the SG still admits only the edge — but the defense-in-depth intent of §2 was dropped).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 file changed,
+12
−0
docs/superpowers/specs/2026-08-11-rails-behind-carlos-edge-poc-design.md+12 −0
diff --git a/docs/superpowers/specs/2026-08-11-rails-behind-carlos-edge-poc-design.md b/docs/superpowers/specs/2026-08-11-rails-behind-carlos-edge-poc-design.md| index d635214cc..c84ddc170 100644 |
| --- a/docs/superpowers/specs/2026-08-11-rails-behind-carlos-edge-poc-design.md |
| +++ b/docs/superpowers/specs/2026-08-11-rails-behind-carlos-edge-poc-design.md |
| @@ -145,6 +145,18 @@ poll the health endpoint → report. No SSH, no new tooling. The tag |
| deployed is whatever CI pushed for k8s staging, so the two deployments |
| stay comparable during the parallel-run phase. |
| +### Recorded deviations (execution) |
| + |
| +- **Box SG ingress uses the IE edge's private IP `/32` |
| + (`172.31.4.137/32`) rather than an SG reference** — the peering is |
| + cross-VPC, and a security group cannot be referenced across the peering |
| + boundary the way §2 assumed. Breaks silently if the IE box is ever |
| + replaced at a new private IP; re-point the ingress rule then. |
| +- **The web port is published on all interfaces, not the private IP |
| + only** — §2 said "the box's private IP"; what's running binds |
| + `0.0.0.0`. Exposure is nil in practice (the SG admits only the edge), |
| + but the defense-in-depth intent of §2 was dropped. |
| + |
| ### 7. What the PoC deliberately surfaces (the roadmap fallout) |
| CARLOS gives these routes routing + TLS and nothing else. Every gap met is |