| index 897b35397..35d4d276b 100644 |
| --- a/docs/superpowers/specs/2026-10-21-instance-sizes-and-egress-design.md |
| +++ b/docs/superpowers/specs/2026-10-21-instance-sizes-and-egress-design.md |
| @@ -1,9 +1,9 @@ |
| # Instance sizes and egress allows |
| |
| Amadan #328 (an isolated instance reaching a private service its operator |
| -runs) and #329 (operator-set CPU and memory per instance). Revision 6, |
| -2026-10-21. Revisions 2 to 6 answer the builder check, Astra rounds |
| -1 to 5, and Paul's ruling on fleet addresses (`CODEX-FINDINGS-instance-sizes-egress-R<n>.md`); the |
| +runs) and #329 (operator-set CPU and memory per instance). Revision 7, |
| +2026-10-21. Revisions 2 to 7 answer the builder check, Astra rounds |
| +1 to 6, and Paul's ruling on fleet addresses (`CODEX-FINDINGS-instance-sizes-egress-R<n>.md`); the |
| dispositions are §9. |
| |
| Both are the same mechanism: **an operator-set policy for an app and its |
| @@ -141,9 +141,29 @@ that way. |
| purges alike. As a second guard, the console's app-create door deletes |
| any policy object still at that key before the name is usable. A new |
| app of an old name therefore never inherits an egress grant or a |
| - default size from its predecessor. Residual: only a console downgraded |
| - to a version without this sweep, after policies exist, could leave one |
| - behind; the release notes say so. |
| + default size from its predecessor. |
| +- **Older consoles** (Astra R6, R5-1): a console without this sweep that |
| + shares the bucket could purge an app and recreate its name while a |
| + policy exists (its purge, `ownership.go:514`, never touches |
| + `control/app-policy/`; its create, `server.go:4130`, never clears it). |
| + Two rails: |
| + - **Rollout rule:** no policy is granted until every console that |
| + writes the deployment's bucket runs this version. A deployment runs |
| + one console per bucket today (temporary static sites spec, "one |
| + console per deployment bucket, which is how every deployment runs"), |
| + so the console that serves the policy door is the one that purges |
| + and creates; a deployment with more than one upgrades them all first. |
| + A console downgraded below this version after policies exist must |
| + delete them first; the release notes and the downgrade runbook say |
| + so. |
| + - **With host claims on, the policy is bound to the app's incarnation:** |
| + it carries the app's `app_id` (`ClaimAppID`, the identity the claim |
| + purge journal and admissions already use, `hostops/admission.go`), |
| + and root ignores a policy whose `app_id` is not the current app's, |
| + reporting `policy for another incarnation`. Any purge and recreate, |
| + by any console version, then fails safe under claims. (Before claims |
| + there is no store-visible app incarnation; the rollout rule is the |
| + rail there.) |
| - **Precondition the builder must verify and record in the plan:** the |
| key is under the store's control boundary (`hostops/mutation_boundary.go` |
| and the bucket policy), so no app, build, instance or member |
| @@ -458,6 +478,8 @@ default and the overrides. |
| - An older console cannot erase the policy: it never writes |
| `control/app-policy/`. |
| - Boxes before consoles, dev first (standing roll order). |
| +- No policy is granted until every console writing the bucket runs this |
| + version (§3, older consoles). |
| - Root code changes: a census overlay and a #280 ruling before merge. |
| - Nothing is on by default. With no policy object, every unit, slice and |
| probe line is byte-identical to today. |
| @@ -534,6 +556,12 @@ does exist, at `internal/activator/`. |
| | new 1 | A recreated app of the same name inherits the policy | Accepted: the purge sweeps the policy object, and app creation clears a lingering one (§3) | |
| | new 2 | A test still required root to enforce other boxes' addresses | Accepted: test and anti-goal reworded to ruling 8 (§2, §11) | |
| |
| +**Astra round 6** (REJECT; everything else resolved, no new findings): |
| + |
| +| # | Finding | Disposition | |
| +|---|---|---| |
| +| R5-1 | An older console in a mixed rollout can purge and recreate under a live policy | Accepted: rollout rule (every console upgraded before the first grant), and an `app_id` binding root checks under claims (§3) | |
| + |
| ## 10. Left to the builder |
| |
| - Column names, the call shapes, and the status snapshot fields. |
amadan