amadan
docs: instance moves — brief for Astra's ruling recommendations
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+101
−0
docs/superpowers/specs/CODEX-RULINGS-BRIEF-INSTANCE-MOVES.md+101 −0
CI passed — run details
diff --git a/docs/superpowers/specs/CODEX-RULINGS-BRIEF-INSTANCE-MOVES.md b/docs/superpowers/specs/CODEX-RULINGS-BRIEF-INSTANCE-MOVES.md| new file mode 100644 |
| index 000000000..a547001f3 |
| --- /dev/null |
| +++ b/docs/superpowers/specs/CODEX-RULINGS-BRIEF-INSTANCE-MOVES.md |
| @@ -0,0 +1,101 @@ |
| +# Brief: recommend rulings for the instance-moves design |
| + |
| +You are advising Paul, who owns the CARLOS platform, on the decisions the |
| +design record `docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md` |
| +needs before its slices P1–P9 are planned. Read the whole record first. Its |
| +predecessor, `2026-08-28-instance-move-design.md` (#331, shipped), is |
| +background: its never-two-writers cut ordering is settled and not up for |
| +review. |
| + |
| +You are not reviewing the record for defects this time. You are giving a |
| +recommendation on each decision, grounded in the code, that Paul can accept |
| +or override one at a time. |
| + |
| +## State of play |
| + |
| +- The record is a DRAFT filed as amadan discussion carlos/platform #175. |
| + Tito Go is the first adopter; its half is in `teamtito/titogo` (not in |
| + this checkout, so reason from what the record quotes of it). |
| +- **P0 is merged on `main` (408db5e, 2026-09-25), not rolled.** It added: the |
| + cut installs the activator's maintenance fence (`FenceAndStop`) before |
| + trusting `Quiesced`, lifted by a new `LiftFence` once the box no longer |
| + holds the route or the record is at rest here; `ServeScheduled` refuses a |
| + managed route whose status is not ready; the moves pass is serialised; |
| + `MoveAbort` allowlists `preparing`/`ready`; a replica record cannot be |
| + moved. This worktree is on the docs branch and may not contain P0; read |
| + it with `git show origin/main:<path>` if you need it. |
| +- First customer path: elatromme → us needs P0, P7, P9, P6, P1, P2, P3. |
| +- Paul's standing rules that bound every answer (AGENTS.md): every `carlos` |
| + command must complete its job for a user with no box or AWS access; the |
| + platform is for general use, so a capability an app needs is built into |
| + the platform rather than worked around in one tenant; production |
| + infrastructure changes need scoped approval. |
| + |
| +## The decisions |
| + |
| +Thirteen, in two groups. Use these ids. |
| + |
| +**Proposed rulings (record §3).** For each: accept, accept with a change, |
| +or reject. |
| + |
| +- **R1** The platform owns the freeze (hooks declared; no hook = today's |
| + #331 behaviour; the freeze buys grace, not correctness). |
| +- **R2** Hooks ride the tick's trust path: `ServeHook` over the instance |
| + socket with the instance admin token. |
| +- **R3** Stores follow only when declared, and only platform-provisioned |
| + stores. |
| +- **R4** Rollback after the cut is a move back, never an automatic undo, so |
| + moves to and from home must work (P3, `CARLOS_HOME_PLACEMENT`). |
| +- **R5** An app's own router stops routing by location and uses a box-local |
| + edge door (P7). |
| + |
| +**Open questions (record §14).** For each: pick an option (the record's or |
| +your own). |
| + |
| +- **Q1** Freeze budget vs measured cut time: accept an app unfreezing while |
| + its process is already stopped, or refuse to cut when the measured cut |
| + time exceeds the declared budget? |
| +- **Q2** Replicas on a move of a home: carry placements unchanged, refuse |
| + while replicas exist, or re-point? |
| +- **Q3** The edge door's identity: per-app unix group, or the app's scoped |
| + key? Consider the isolated layout's uid model |
| + (`2026-09-11-isolated-exec-design.md`) and G18 (every enrolled process). |
| +- **Q4** Control-plane residency: data moves, the record/bundle/secrets/log |
| + stay in the home region's bucket. State that as the promise, or regional |
| + copies of the config bundle? |
| +- **Q5** Self-serve before #171 (a region box's IAM role can write any |
| + account's records): operator-only move doors for other accounts until |
| + #171 is fixed? |
| +- **Q6** Store copies: a short-lived move-scoped IAM user that can read one |
| + tenant store, or a hook the app runs with its own store credential? |
| +- **Q7** Route ownership for direct-mode `carlos add` (G17): explicit |
| + `--account`, inherit the app's account, or refuse when the host's app |
| + belongs to another account? |
| +- **Q8** Adoption downtime: a scheduled per-account stop window, or a |
| + replicate-then-cut adoption shape? |
| + |
| +## What to produce |
| + |
| +Write markdown to the output file. For each of the thirteen, in this shape: |
| + |
| +``` |
| +### <id>: <one-line question> |
| +**Recommendation:** <the choice, one sentence> |
| +**Why:** <3–6 sentences. Cite code as path:line where the argument rests on |
| +it, and check every citation against this checkout (or origin/main).> |
| +**If wrong:** <what breaks, and how hard it is to reverse later> |
| +**Blocks:** <which slices cannot be planned until this is ruled> |
| +**Confidence:** high / medium / low |
| +``` |
| + |
| +Then three short closing sections: |
| + |
| +1. **Order to rule them in**, favouring what unblocks the elatromme path. |
| +2. **Decisions the record is missing**: anything Paul must rule that is not |
| + in the thirteen. At most five, each with a recommendation in the same |
| + shape. |
| +3. **Where you disagree with the record's own proposal**, one line each. |
| + |
| +Be direct. Where two options are close, say so and say which way you lean. |
| +Do not re-open #331's cut ordering or anything P0 settled. Keep the whole |
| +answer under about 2,500 words. |