amadan
spec: region HA spec 1 rev 5.3, Astra round 4 findings (unedited)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+49
−0
docs/superpowers/specs/CODEX-FINDINGS-REGION-HA-REV5-4.md+49 −0
diff --git a/docs/superpowers/specs/CODEX-FINDINGS-REGION-HA-REV5-4.md b/docs/superpowers/specs/CODEX-FINDINGS-REGION-HA-REV5-4.md| new file mode 100644 |
| index 000000000..ed109ea37 |
| --- /dev/null |
| +++ b/docs/superpowers/specs/CODEX-FINDINGS-REGION-HA-REV5-4.md |
| @@ -0,0 +1,49 @@ |
| +| Prior finding | Disposition | Answer in rev 5.3 | |
| +|---|---|---| |
| +| B3-1 — Recycle Bin | **Moot under H19; agreed.** | §5.9 separates execution fencing from disk retention. Surviving copies are outside this review’s scope. | |
| +| B3-2 — `CopyVolumes` | **Moot under H19; agreed.** | §5.9 requires no proof that disk copies cannot exist. Copies grant no execution authority. | |
| +| B3-3 — Auto Scaling tag overwrite | **Moot under H19; agreed.** | §5.1 and §6 remove the tag-conditioned guard. Identity comes from the enrolled `cloud` binding. | |
| +| B3-4 — Concurrent revocation cutoffs | **Moot under H19; agreed.** | §5.9 and §6 withdraw holds, releases and the change role. | |
| +| B3-5 — Outstanding Auto Scaling workflows | **Moot under H19; agreed.** | The release barrier is withdrawn. Disk changes affect chore discharge only (§5.9, L3). | |
| + |
| +Reviewed `27058fe1` against claim `98b45332`, moves `a4711728`—the latest committed revision of that spec in the supplied worktree—and main code at `09814f7f`. |
| + |
| +**Focus 2: no two-writer or data-loss path found that depends on disk evidence.** There is, however, a remaining startup gate that can make recovery depend on volume recording. |
| + |
| +| Mechanism | Result | |
| +|---|---| |
| +| Fence (§5.9, L2) | Requires positive `terminated` evidence bound to the roster’s account, region and instance ID. No volume, tag or IAM-guard input. AWS documents that a terminated instance cannot restart. [AWS lifecycle contract](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-lifecycle.html) | |
| +| Census (L5, L20) | Fence references exclude dead boxes and their bound consoles. Stale-console acceptance uses the authenticated report and permanent floor guard. Neither reads disk evidence. | |
| +| Relocation (§5.8) | Execution transfer uses stop evidence or the fence. Database recovery uses pinned remote versions; files use their independently selected manifest. | |
| +| Open local chores | Claim CC11 and main’s `StartGuard` distinguish box-local chores from regional chores. A chore on the dead source does not block writes on a different target. L11 separately addresses pending generation parks. | |
| +| Updates (§5.10) | Exclusion uses roster activation reservations and durable local controller/update records, including failed-cleanup state. No volume records or cloud tags. | |
| +| H17 confirmer (§5.1) | Uses enrolled identity, group membership and positive terminal reads for existing enrollments. No disk or IAM-guard evidence. | |
| +| Surviving-disk admission | C4 requires the current executor; §6.4 requires fresh authority and the installation stamp; P6-D2 refuses ambiguous artifact ownership. §6.4a/R6 purges and restores the database from remote storage. A copied disk supplies none of that authority. | |
| + |
| +These are design guarantees, including the specified claim proposals and amendments, rather than a claim that main already implements the complete admission boundary. §19 correctly keeps `termfence.Verify` free of volume inputs and separates chore discharge. |
| + |
| +**New findings** |
| + |
| +1. **B4-1 — P2: Volume recording remains a runtime admission prerequisite.** |
| + |
| + **Sections:** [§8, multi-box gate](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md:1339), §19’s plan 1b item 8. |
| + |
| + The gate still requires regional workers to be writing volume records for every box. Each box checks this gate at startup and refuses to mint relocatable rows when it fails. H19 removed disk evidence from recovery, but this surrounding gate retains an indirect dependency. |
| + |
| + **Failing sequence:** In an enabled two-box region, publication under `control/box-volumes/` fails while claim, fence and data-bucket access remain healthy. A recovery target restarts. It cannot satisfy §8’s recording requirement and refuses relocatable rows. The other executor then terminates; valid terminal evidence exists, but recovery cannot establish the target’s row. |
| + |
| + **Suggested fix:** Make volume-recorder failure an alert and a reason to leave local chores open. Explicitly exclude it from startup, row-admission and recovery gates. If §8 means only checking that recorder support was shipped during initial rollout, say so and separate that check from runtime recovery. Extend the missing-record test through startup and row creation. |
| + |
| +2. **B4-2 — P3: Operational summaries still describe the superseded disk-dependent fence.** |
| + |
| + **Sections:** [§5.8, source-loss table](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md:944), [§6, Tofu paragraph](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md:1297), [§7, one-box recovery](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md:1308). |
| + |
| + §6 still says H10 refuses fencing when a volume survives. §7 constructs the fence “from its predecessor’s last volume record.” The source-loss table still describes chore discharge unconditionally. H19 made these statements stale. |
| + |
| + **Failing sequence:** A source terminates during `starting` with a recorded `false` volume. Following the table literally discharges its chores; following the Tofu rationale refuses its fence. H19 requires successful fencing and retained chores. |
| + |
| + **Suggested fix:** Apply §5.9’s separation consistently: terminal evidence establishes the fence; qualifying volume evidence permits chore discharge; otherwise chores remain open while recovery proceeds. |
| + |
| +No files changed or tests run; this was a source and contract review. |
| + |
| +**Verdict: not ready for plan until B4-1’s runtime dependency is removed or explicitly excluded.** |
| \ No newline at end of file |