amadan
docs: P7 plan, as built: Fable's final-review notes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+9
−0
docs/superpowers/plans/2026-09-28-instance-moves-p7-edge-door.md+9 −0
CI passed — run details
diff --git a/docs/superpowers/plans/2026-09-28-instance-moves-p7-edge-door.md b/docs/superpowers/plans/2026-09-28-instance-moves-p7-edge-door.md| index 7598aba2b..0ac77d17b 100644 |
| --- a/docs/superpowers/plans/2026-09-28-instance-moves-p7-edge-door.md |
| +++ b/docs/superpowers/plans/2026-09-28-instance-moves-p7-edge-door.md |
| @@ -790,6 +790,15 @@ func doorRefused(w http.ResponseWriter) { |
| --- |
| +## As built: notes from Fable's final review (2026-09-29) |
| + |
| +No blockers. Three notes were fixed on the branch: the racing-renewal test counts Puts, so it pins the lock; `Verify` refuses a record signed more than `MaxClockSkew` (5 minutes) ahead; the socket is bound in a private directory and renamed into place. The rest are recorded here: |
| + |
| +- **Mint when publishing fails** revokes the fresh key and answers 502, where Task 2 said "saved but not yet published". The key has been shown to nobody, so keeping it would strand a slot. It costs two revision bumps. Revoke keeps Task 2's 502. |
| +- **The door's address is read once, at agent start.** The edges-file loop re-probes it every tick. That matches the agent's own assumption that an EIP cannot change under a running box (`edgesfile.go:531`). If a box's EIP is ever re-associated, restart its agent, or the door keeps presenting the old address. |
| +- **Runbook line:** if the console database *and* the bucket are both restored below a revision an edge has already admitted, that edge refuses the app's keys once its kept record expires (72 h at most), until the console climbs past the mark or the agent restarts. |
| +- **Reachability, not authority:** the door needs no certificate or DNS for the host, so a route whose certificate never issued is reachable through the door only. It refuses every path on the steering hostname, where the public branch intercepts only `GET /`. Both are less than or equal to the public door. |
| + |
| ## Rollout (for the handoff, not a task) |
| 1. Consoles first (they publish records nothing reads yet), then boxes (they publish owners, but open no socket). |