amadan
Astra stage B plan round 2: unedited
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+72
−0
docs/superpowers/plans/CODEX-PLAN-REGION-HA-STAGE-B-R2.md+72 −0
diff --git a/docs/superpowers/plans/CODEX-PLAN-REGION-HA-STAGE-B-R2.md b/docs/superpowers/plans/CODEX-PLAN-REGION-HA-STAGE-B-R2.md| new file mode 100644 |
| index 000000000..1b2c6a3d2 |
| --- /dev/null |
| +++ b/docs/superpowers/plans/CODEX-PLAN-REGION-HA-STAGE-B-R2.md |
| @@ -0,0 +1,72 @@ |
| +Reviewed `1651ff7d`, with plan rev 2 at `a73c430f`. |
| + |
| +1. **P1 — O2 reopens the lost-key hazard.** [Plan:1058](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:1058) accepts any nonempty `CARLOS_INSTANCE_KEY`. An app can ignore that variable, generate its own `instance.key`, commit sealed data, then die before publishing that file. This pin now succeeds and restores data without its actual key. The proposed string-presence test explicitly accepts this unsafe state. Require evidence that the pinned app version uses the env key, including migration evidence for existing databases; otherwise retain ruling 25’s refusal. Add the negative case with an unused platform key and an unpublished app key. |
| + |
| +2. **P1 — The local install invalidates its own receipt CAS.** [Plan:1833](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:1833) calls `park.Local.RecordInventory`, which updates the claim on every call (`internal/park/local.go:330`). `Participant.Step` subsequently calls `RecordLocalInstall` using its original observation (`internal/hostrelocate/participant.go:165`). That CAS conflicts. Retrying repeats the inventory update and conflicts again, leaving the relocation in `installed`. Re-read and validate the operation after installation—and after any repairing `EnsureLocal`—before recording the transition. Test through `Participant.Step`, not just direct `Install` calls. |
| + |
| +3. **P1 — The first probe refuses the directory created by installation.** [Plan:1848](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:1848) creates `InstanceDir` directly. `MintHeld` records only the route in the typed stop inventory; `park.Local.RecordInventory(..., nil, ...)` does not record the directory’s ownership or inode. Main’s `ClaimRoleAssembly.PrepareState` refuses an existing directory without that typed path entry (`claimroleassembly_linux.go:339`). Reuse its intended/materialized directory protocol before restoring files. The integration test must retain the real `PrepareState`. |
| + |
| +4. **P1 — Root rejects every later cold probe attempt.** [Plan:3172](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:3172) requires `holder.stamp == install_stamp`. Only P’s first admission keeps that stamp; subsequent cold admissions advance it (`hostclaim/generation.go`). The new journal correctly records the later stamp, but root rejects it before consulting that record. Validate the reservation against the current writer stamp; restrict the install-stamp equality to P’s opening. Add successful second- and third-attempt launches through root. |
| + |
| +5. **P1 — Completion leaves main’s participation denial uncleared.** [Plan:3520](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:3520) releases the row and activator fence while relying on main to finish participation. Main’s cleanup retains the observation captured when its controller opened (`claimparticipation.go:184`, `:127`). After probing and the serving CAS, that observation no longer matches the current writer, so `stopCapturedSession` refuses. The slot and `.hostexec` record remain; both local serving authority and root reject them. Specify cleanup using the exact completed probe evidence before serving admission, and test completion without restarting the agent. |
| + |
| +6. **P1 — C7’s proposed serving-shaped re-stop cannot reuse the live producer drain.** [Plan:136](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:136) leaves this as an experimental question, but the same-process path has a concrete conflict. The relocating stop pins `ClaimProducers.fence`; the serving-shaped stop creates a different fence, which `DrainClaim` rejects (`claimstop_producers.go:77`). Merely expecting another receipt will not work. |
| + |
| + Keeping activation disabled is safe. A new claim semantic is not demonstrably necessary, however: existing `ColdHandover.Run` accepts an exact prior receipt and a separately validated successor, without requiring their operation IDs to match. Specify how completion preserves and supplies that receipt through the existing handover contract, together with participation cleanup, rather than relabelling or re-draining the stopped session. |
| + |
| +7. **P1 — Remote build authority still omits execution-lease loss.** [Plan:1198](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:1198) retains a build check over claim fields and the guard stamp. `Local` runs during activation, but is not specified for subsequent build writes. The inherited cancellation watches the replica lease; main’s `cancelWork` only cancels pending wake attempts. Therefore an execution lease can expire while the replica lease, claim and guard remain unchanged, and the build continues publishing. Require execution authority at each durable build step and test losing only the execution lease mid-build. |
| + |
| +8. **P2 — Renaming journals by operation does not exempt them from the census.** [Plan:1592](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:1592) assumes avoiding host names is sufficient. `EmptyInstallationCensus` also refuses every unclassified regular file (`empty_census.go:144`), and `claimDataCensus` does not classify `relocate/ops` or `relocate/release`. Retained journals therefore block later initialization even after the corresponding installation is retired. Define their census classification and lifecycle explicitly; test initialization with journals from a previous relocation present. |
| + |
| +9. **P2 — Recovery verifies env existence, not its contents.** [Plan:1497](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:1497) accepts any existing env path when `EnvItem` exists. A truncated file, wrong key, directory or symlink passes. `EnsureLocal` then skips repair before P opens. Check regular-file type, size and digest against the platform entry, with explicit deleted-entry handling. Add corruption cases after a successful install. |
| + |
| +10. **P2 — The replacement promised for retired installations is not reachable from `installed`.** [Plan:181](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:181) correctly forbids reactivating a retired stamp, but promises the probe deadline will replace the target. That deadline starts only after `ToProbing`; a refusing `EnsureLocal` in `installed` prevents that transition indefinitely. In `probing`, C1 also prevents the claimed automatic live-target replacement. Specify the actual bounded failure/operator outcome and test both phases. |
| + |
| +11. **P2 — C6’s fallback and the replacement lifecycle coverage are incomplete.** [Plan:171](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:171) says main’s census always preserves denial for an unopened installation. But `CheckLocal` returns success immediately for matching complete installation metadata (`empty_census.go:58–63`). If participation opened at the install stamp, cleanup can succeed and `ClearStale` can remove denial while the installation remains. |
| + |
| + The deleted 200-seed test covered lease loss, cleanup failures/timeouts, corrupt records, crashes and successors arriving before cleanup. The two discovery-order cases do not replace that coverage. Port the relevant scenarios to `productionClaimLocal`, explicitly testing retained installations, successful completion and subsequent operations. Adjust recovery expectations for the deliberate no-reactivation rule. |
| + |
| +The round-1 dispositions are therefore: |
| + |
| +| Round-1 finding | Assessment | |
| +|---|---| |
| +| 1 | Duplicate controller removed; production cleanup remains unresolved. | |
| +| 2 | Empty-target activation is specified correctly; end-to-end success remains unproved. | |
| +| 3 | Row ordering improved; receipt CAS and typed directory ownership still fail. | |
| +| 4 | Nested-only destination is sound for the stated admission restrictions. | |
| +| 5 | Claim-aware staging fixes the identified refusal; M3 remains a valid activation gate. | |
| +| 6 | Prepared publication now follows the assembly contract. | |
| +| 7 | Reader and preflight added; later attempts are incorrectly refused. | |
| +| 8 | Explicit stop is appropriate; participation cleanup and handover remain unresolved. | |
| +| 9 | Separate store construction fixes the type assertion. | |
| +| 10 | Main’s WorkSource restores checks for guarded install work; remote build authority remains incomplete. | |
| +| 11 | C8/O1 is now correctly an explicit dependency with a safe disabled fallback. | |
| +| 12 | Logical and cloud regions are correctly separated. | |
| +| 13 | No reactivation is sound; the promised recovery outcome is not implemented. | |
| +| 14 | Field names and JSON tags are corrected. | |
| + |
| +The proposed end-to-end test is concrete enough to become a useful regression and would fail rev 1 if implemented with the real assembly paths. It is still a specification, not evidence of closure. It must preserve production participation, typed inventory and handover behavior, then add retry and restart cases. |
| + |
| +**Verdict: not ready to build.** |
| + |
| +Static review only. No files changed or tests executed. |
| + |
| +--- |
| + |
| +**FIRST PROMPT:** |
| +Review the stage B plan at `1651ff7d`, revision `a73c430f`, following brief 2. |
| + |
| +**WHAT:** |
| +Check prior findings, changed dispositions, dependencies and new defects. |
| + |
| +**STATUS:** |
| +Review complete: seven P1 and four P2 findings. |
| + |
| +**NEEDED:** |
| +Nothing. |
| + |
| +**RECOMMENDED:** |
| +Revise the plan and integration tests around these findings before implementation. |
| + |
| +**SESSION:** |
| +Safe to close. Nothing started remains running; no handoff file written in this read-only workspace. |
| \ No newline at end of file |