amadan
Astra round 5 findings on the nearest-region spec, unedited (verdict: ready for planning)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+29
−0
docs/superpowers/specs/CODEX-FINDINGS-NEAREST-REGION-R5.md+29 −0
CI passed — run details
diff --git a/docs/superpowers/specs/CODEX-FINDINGS-NEAREST-REGION-R5.md b/docs/superpowers/specs/CODEX-FINDINGS-NEAREST-REGION-R5.md| new file mode 100644 |
| index 000000000..c4e1adc89 |
| --- /dev/null |
| +++ b/docs/superpowers/specs/CODEX-FINDINGS-NEAREST-REGION-R5.md |
| @@ -0,0 +1,29 @@ |
| +Reviewed rev 5 at `761b8eb1` against the clean worktree, after reading AGENTS.md, rounds 1–4, and the dispositions in **§21**. “Resolved” below means resolved in the design; implementation remains ahead. |
| + |
| +| Round-1 finding | Status | Why | |
| +|---|---|---| |
| +| 1. Picker bypasses pool exclusion | Resolved | Pooled manifests yield no candidates or guess; target boxes must positively advertise shared-pool eligibility. | |
| +| 2. Browser adoption changes the default | Resolved | `@auto` remains distinct from an explicit choice, and inference follows adoption detection. | |
| +| 3. Unnamed home prevents override | Resolved | Non-home app defaults require a named home, providing an explicit-home override. | |
| +| 4. Mixed versions and rollback unspecified | Resolved | Read-first rollout, switch behavior, and the region-aware binary floor are specified; R7 settles enforcement. | |
| +| 5. Existing-canary `--region` undefined | Resolved | Equal proceeds; different refuses before mutation or upload. Fleet placement now has a consistent refusal before either branch. | |
| +| 6. Manifest absence versus failure unspecified | Resolved | Absent, known, and unreadable policies have distinct behavior; legacy topology remains available. | |
| +| 7. Unavailable-default explanation disappears | Resolved | `app_default` represents absent regions, and C8 does not depend on the number of alternatives. | |
| +| 8. Query hints reflected by redirects | Resolved | Hints use POST bodies, with privacy assertions covering redirects, errors, logs, and audit. | |
| + |
| +**No new P1, P2, or P3 findings.** The three round-4 corrections are sufficient at design level. |
| + |
| +The requested checks support proceeding: |
| + |
| +- **Create precedence:** The insertion follows placement resolution and precedes replica validation, policy validation, and the armed gate in [apiinstances.go:763](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/console/apiinstances.go:763). Its conditions preserve fleet, pool, replica, static, and address-backed exclusions. [DerivesPaths:343](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/provision/provision.go:343) matches the intended socket-backed shape; sidecars retain their separate door. |
| +- **Migration:** ALTERs precede `migrateAppsKey` at [store.go:402](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/console/store.go:402). §5.2 correctly requires updating the rebuild DDL and both sides of the copy at [store.go:487](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/console/store.go:487). |
| +- **Compatibility:** The existing permissive request decoder at [authcli.go:945](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/console/authcli.go:945) and response unmarshalling at [apimode.go:1013](/home/paulca/amadan.net/carlos/platform-nearest-region/apimode.go:1013) support additive fields. Existing apps retain their home default. |
| +- **Policy and availability:** §6.4 constrains every non-null guess through the normalized allow-list predicate; §7 rechecks placement before writing. A stale guess can be refused, but cannot bypass policy. Migrated apps avoid the new non-home eligibility refusal. For non-home apps, explicit overrides remain policy-bound: if all allowed destinations are unavailable, capacity or policy must be repaired. |
| +- **Privacy:** The proposed persistent fields contain only region and source. Request-local hints and coordinates require no retention; POST bodies avoid the query reflection at [server.go:1306](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/console/server.go:1306). |
| +- **Rollout:** Box publication precedes activation, region-aware reads survive switch-off, and the new service gate checks actual public and cross-edge requests. That addresses the separate mesh-key dependency at [edge.go:2699](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/edge/edge.go:2699). Phase L remains gated separately under R8. |
| + |
| +There are **no open questions to answer** in this revision: §17 contains rollout, and §18 explicitly says none. The earlier completion, latency-sequencing, and rollback questions are settled by R5, R8, and R7 respectively. |
| + |
| +All code citations above were checked. No files changed, no tests ran, and production configuration was not inspected. |
| + |
| +**Verdict: ready for planning.** The placement design now defines the necessary precedence, migration, compatibility, privacy, and rollout safeguards without depending on Phase L. |
| \ No newline at end of file |