carlos / platform Public

plan: region HA 1b, Astra round 1 findings (unedited)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Paul Campbell pushed by claude 2 weeks ago debca2753e7d4d4421f1529a313758ab5cfbc407 parent 856767d

1 file changed, +19 −0

docs/superpowers/plans/CODEX-PLAN-REGION-HA-1B-R1.md +19 −0

diff --git a/docs/superpowers/plans/CODEX-PLAN-REGION-HA-1B-R1.md b/docs/superpowers/plans/CODEX-PLAN-REGION-HA-1B-R1.md

new file mode 100644

index 000000000..62630ca31

--- /dev/null

+++ b/docs/superpowers/plans/CODEX-PLAN-REGION-HA-1B-R1.md

@@ -0,0 +1,19 @@

+Reviewed `856767d8` against the working tree and rev 5.4. Seven findings:

+1. **P1 — Task 8, Steps 2–4: the prescribed cleanup breaks the next validation.** Step 2 removes `.terraform/` and `.terraform.lock.hcl`; Step 4 runs `tofu validate && tofu test` without initializing again ([plan:3538](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/docs/superpowers/plans/2026-10-06-region-ha-1b-claim-readers.md:3538), [plan:3631](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/docs/superpowers/plans/2026-10-06-region-ha-1b-claim-readers.md:3631)). I reproduced `Missing required provider` with `tofu validate` in the uninitialized module. **Fix:** retain initialization through Step 4, or repeat `tofu init -backend=false -input=false` before validation.

+2. **P2 — Task 6, Step 4: aliases and wildcard homes lose the installation stamp.** The new call stamps primary routes before alias construction, but existing constructors create fresh entries without `Stamp` ([edgesfile.go:458](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/internal/host/edgesfile.go:458), [edgesfile.go:542](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/internal/host/edgesfile.go:542)). After failover, both the dead box’s alias and its successor’s alias therefore have stamp zero. `dialBeats` retains the first sorted box on that tie, potentially routing custom-domain traffic to the dead box indefinitely. The proposed test checks withholding only. **Fix:** copy the primary’s stamp into exact aliases and served wildcard entries; test both against a stale predecessor’s file.

+3. **P2 — Task 7, Steps 3–4: participation refusal permanently suppresses that release.** `beginExecutableChange` returns `errSystemRefused`, which is recorded as `refused` ([plan:3385](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/docs/superpowers/plans/2026-10-06-region-ha-1b-claim-readers.md:3385)). That outcome is terminal to the agent ([systemstate.go:75](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/internal/host/systemstate.go:75)); both observation and pending-request processing stop retrying it ([systemleg.go:121](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/internal/host/systemleg.go:121)). Removing `.hostexec` records consequently does not resume the update, contrary to §5.10 and the plan’s retry claim. **Fix:** record participation as a retryable deferral and test refusal → participation cleared → same promote applied through the agent.

+4. **P2 — Task 6, Step 3: failed reads can starve healthy claims indefinitely.** Failed reads leave both entry existence and `readAt` unchanged ([plan:2920](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/docs/superpowers/plans/2026-10-06-region-ha-1b-claim-readers.md:2920)). With 256 permanently unreadable claims first in the ordering, every pass selects those same claims; later healthy claims are never read or refreshed. **Fix:** track attempts separately from successful decisions and rotate or back off failures while retaining their last decisions. Add a test with 256 failing claims followed by a readable claim.

+5. **P2 — Task 6, Steps 3–4: the publisher cannot sustain the stated ten-minute refresh.** Reads are capped at 256 per pass, but the unchanged scheduler normally runs only every five to six minutes when the registry is stable ([plan:2916](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/docs/superpowers/plans/2026-10-06-region-ha-1b-claim-readers.md:2916), [edgesfile.go:740](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/internal/host/edgesfile.go:740)). The plan’s 2,000-host example needs eight passes: roughly 40–48 minutes per refresh cycle. Existing tests call the cache directly and bypass this scheduling constraint. **Fix:** schedule additional bounded passes while claim reads remain due, independently of registry changes, and test the combined scheduler/cache behavior.

+6. **P2 — Task 5, Step 3: incomplete records can authorize discharge.** `List` checks JSON syntax, while `Discharge` never validates `InstanceState` or the presence of mapping evidence ([plan:2446](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/docs/superpowers/plans/2026-10-06-region-ha-1b-claim-readers.md:2446), [plan:2513](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/docs/superpowers/plans/2026-10-06-region-ha-1b-claim-readers.md:2513)). A record containing only matching version, enrollment, cloud and an in-window timestamp passes: both volume loops are empty. A `terminated` record with empty mappings also passes despite the recording prohibition. Unknown versions are silently skipped, potentially hiding adverse history. **Fix:** validate same-enrollment records before evaluating discharge; incomplete, non-recordable or unsupported evidence must leave chores open. Add persisted-record tests, beyond `Observe` tests.

+7. **P2 — Task 8, Step 1: the policy test does not establish create-only or never-deleted behavior.** Its sole assertion compares resource sets ([plan:3517](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/docs/superpowers/plans/2026-10-06-region-ha-1b-claim-readers.md:3517)). Changing either statement to `Allow`, removing a delete action, or breaking the conditional-write condition still passes. **Fix:** assert effect, principal, actions and conditions as well as exact resources; verify that mutations disabling each protection fail the test.

+All 15 complete Go file blocks passed syntax parsing with `gofmt`. Full compilation and proposed tests were not run because the sandbox is read-only. No files changed.

+**Verdict: not ready.**

\ No newline at end of file