carlos / platform Public

The attach door must not alias a custom domain onto a sidecar

Found by rerunning the sweep a second time, against the 405 commits main
moved between the first catch-up and this one. §14 was exhaustive on
2026-09-05; the point of redoing it is that such a list is a fact about the
tree ON A DATE, not about the tree.

readyRouteHost (internal/console/domainattach.go) picks the route a
newly-attached custom domain is aliased onto. Its doc says the selection is
domains.firstReadyUpstream's "minus the upstream copy", which is accurate
about the intent and wrong about the consequence. firstReadyUpstream ends
with a clause this one drops:

    rt.Socket != "" || rt.Addr != "" || (rt.Kind == "static" && rt.Channel != "")

That clause does two jobs. It picks a row with something to COPY — the job
it was written for, and genuinely not needed here, since this function
copies nothing and returns only a host. It is also the question "is this row
dialable at all", and that second, unassigned job is the entire reason a
sidecar never appears in firstReadyUpstream's answer: a sidecar is exactly
the row with no socket and no addr.

Dropping the clause dropped the guard with it. Everything left passes a
sidecar — it is the app's, it is the account's, it is not Platform, and it
is ready, because ready is what makes it runnable. Selection runs in
reg.List's host order, so bot.<app>... sorts ahead of most hosts an app
would really serve from: the sidecar is the FIRST candidate, not a
straggler that wins a tie.

This is not a routing breach. ReconcileAliases already refuses a claim whose
Route carries the reserved suffix, so nothing is ever proxied. It is worse
in a quieter way: the attach returns 200, the claim is written naming a
sidecar, and the box refuses it on every pass from then on. A custom domain
that never serves, and nothing anywhere saying why.

The guard goes at the door, so the console agrees with the box rather than
writing claims for it to reject. Verified by neutralising it and watching
the test fail — the attach aliases echo.example.com onto
bot.story.bab.sidecar.internal.

Also here, in the design's new §15: the sweep's full result, including the
pattern this is the third instance of. The edges file (§14.1), path routing
(§14.2) and this door are one shape three times — a predicate that excluded
sidecars as a SIDE EFFECT of asking something else, then narrowed, copied or
re-derived by someone who correctly read its stated purpose and could not
see the unstated one. §15.2 says what to grep for next time, since
registry.Route and Kind are both the wrong things to look for. §15.4 records
a gap this merge opened rather than closed: StartSidecar gained isolated
exec's layout dispatch and StartWorker, the native path, did not.

Gate: go build, go vet, gofmt -l, the GOOS=darwin and GOOS=windows compiles
and go test ./... -count=1 all clean, less the two failures that reproduce
identically on a clean origin/main worktree (a console login the root
package's tests want, and one activator test whose own name pushes a unix
socket path past the 108-byte sun_path limit).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>