carlos / platform Public

edge: Carlos-Purge-Host — same-app+account cross-host purge override (#24)

* edge: a purge may name a sibling host, if the app and account both match

Tito runs one app across two route groups: admin UIs and Stripe webhooks
ride the root domain (go.tito.io), the cached public pages live on
per-tenant routes ({slug}.go.tito.io). Carlos-Purge is confined to r.Host
by design, so every admin-originated purge landed on a host where nothing
relevant was cached and the edited page served its pre-write body for the
full TTL ceiling — breaking the "admin changes show up immediately"
promise the cache was allowed to exist under.

Carlos-Purge-Host names the host a response's targets apply to instead.
It is resolved against the edge's own CURRENT route table (e.current(),
per response — a sibling added by the reload that rebuilt this proxy must
still validate) and refused unless that route's App AND Account both
equal the serving route's, with App non-empty so two App-less routes on a
box can't purge each other. Host confinement is relaxed to app+account
and nothing wider; the invariant stays structural rather than becoming
permission bookkeeping.

Any failure — unknown host, different app, different account, malformed
value, more than one value — discards the ENTIRE declaration, with no
fallback to the serving host: a half-honoured purge is worse than a
refused one, because it clears something and so looks like it worked.

Both headers are stripped unconditionally (nil cache included) and both
are scrubbed off inbound requests in BOTH Rewrite funcs — reflection
matters here for the same reason it does for Carlos-Purge: a cross-host
purge inside one app is still a purge an outsider must not trigger.

Purely additive: a response without the new header behaves byte-
identically to today, and every existing test is unmodified.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* edge: the account halves resolve, the capture re-checks, the shape table bites

Review wave on the Carlos-Purge-Host override. Two behaviour changes, three
pins, and a fixture correction that turned out to matter more than any of them.

Account was compared as raw column bytes, so a route stamped "" and a route
stamped "bab" read as different tenants — even though release.RouteAccount
resolves both to the built-in ops account, which is what keys the app's bucket
objects everywhere else on the box. A raw comparison never let a purge cross a
real account boundary; it split one account in two and refused a purge between
two routes that provably share one key space. Both halves now go through
RouteAccount.

The serving route is a value captured when the proxy was built, and a reload
can land between that capture and the response. The edge now re-reads the
serving host from e.current() before honouring an override and refuses
(override-stale) when it has left the table or its App/Account no longer match.
Naming your own host is untouched and stays equivalent to omitting the header.

The malformed-shape table was vacuous: none of its twelve shapes is a route key
in its fixture, so the route-table lookup refused them all and the table passed
with validPurgeOverrideHost replaced by `return true`. The two shapes a route
table can genuinely contain — nothing validates a host column — now go INTO the
table as real routes with a matching app and account, so only the shape gate
can refuse them.

The fixture accounts were "acct-1"/"acct-2", neither a valid sqid, so both
resolved to ops. The cross-account test was asserting a boundary it never
crossed. They are now real sqids, and the test carries a note saying why they
have to be.

Also pinned: the Connection footgun, which is the nastiest thing here and is
undetectable edge-side. httputil deletes hop-by-hop headers before
ModifyResponse, so `Connection: Carlos-Purge-Host` deletes the redirect while
the Carlos-Purge line survives — the declaration is silently retargeted at the
serving host. That is a half-honoured purge the all-or-nothing rule exists to
prevent, and the edge cannot refuse it because the evidence is gone before this
package runs. Asserted as today's behaviour so a change screams; documented as
an app obligation in the contract and spec §6.4.

And: a non-ready sibling is not nameable (pins Reload's ready-filter as
load-bearing for the gate), and the lowercase asymmetry is stated as such —
a route key with an uppercase byte is unreachable by override, fail-closed
and accepted.

Spec §6.4 gains the Connection sentence, the RouteAccount rule, the
stale-capture rule, and a note that the 1xx/trailer carve-out can disclose a
sibling hostname (own-tenant, accepted, §6.1's rationale). §8's list records
the additions with their red proofs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>