amadan
S3 change index: Astra round 2 findings (#336)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+17
−0
docs/superpowers/specs/CODEX-FINDINGS-S3-CHANGE-INDEX-R2.md+17 −0
diff --git a/docs/superpowers/specs/CODEX-FINDINGS-S3-CHANGE-INDEX-R2.md b/docs/superpowers/specs/CODEX-FINDINGS-S3-CHANGE-INDEX-R2.md| new file mode 100644 |
| index 000000000..53d96bd1c |
| --- /dev/null |
| +++ b/docs/superpowers/specs/CODEX-FINDINGS-S3-CHANGE-INDEX-R2.md |
| @@ -0,0 +1,17 @@ |
| +| Round 1 finding | Disposition | Reason | |
| +|---|---|---| |
| +| 1. Moves snapshot ordering | Resolved | §4.3 selects the snapshot under `w.pass`, checks epochs, and defines the lock order. | |
| +| 2. Backstop overwrites newer view | Resolved | §§4.3–4.4 serialize incremental refreshes and the entire backstop acquisition/publication under one lock. §8 includes the race witness. | |
| +| 3. Lost store capabilities | Resolved | §3.3 places hooks inside the concrete stores and covers all four mutation methods, preserving existing interfaces. | |
| +| 4. Failed scopes skipped on 304 | Resolved | §4.2 separates observed and applied generations and explicitly retries outstanding scopes on 304. | |
| +| 5. Incorrect/missing manifests | Resolved | §4.1 names both `instances.json` and `sidecars.json`, preserving their parsers and error semantics. | |
| +| 6. Hostops integration | Resolved | §3.3 defines hook placement and bump authority; §3.4 requires read-extension forwarding; §8 tests final claim-enabled handles. | |
| +| 7. Fleet-door access | Resolved | §3.4 explicitly retains ordinary polling for unsupported stores and failed index reads, without exposing the global index. | |
| +| 8. Mesh keys and heartbeat | Resolved | §5 retains independent mesh-key polling and records refresh attempts on unchanged polls. | |
| +| 9. Telemetry backstop | Resolved | §5 supplies first-use reads, independent retries, and a maximum successful-read age. | |
| +| 10. Unrelated per-app reads | **Partly resolved** | §4.5 scopes index-only passes, but explicitly preserves unrestricted serial-triggered adoption/config sync. Ordinary console config writes still bump serial ([apiconfig.go:612](internal/console/apiconfig.go#L612)); those passes read unrelated hosted apps ([agent.go:2827](internal/host/agent.go#L2827), [syncexec.go:178](internal/appconfig/syncexec.go#L178)). The proportional-work goal therefore remains only partly met. | |
| +| 11. Box-publication type assertion | Resolved | §3.3 preserves the concrete `*release.S3Store` identity; §8 requires a publication witness through the enabled opener. | |
| + |
| +1. **P2 — Console orphan-run housekeeping retains an all-app listing loop (§§2, 4.6, 9).** Replacing the record walk with `RecordView` leaves a separate fan-out: housekeeping runs every twentieth 30-second sweep ([runsweep.go:17](internal/console/runsweep.go#L17), [:39](internal/console/runsweep.go#L39)). Every app with an instance record enters its app set, including apps with no active run ([:83](internal/console/runsweep.go#L83)); housekeeping then calls `sweepOrphanRuns` for each app ([:110](internal/console/runsweep.go#L110)), which lists that app’s `runs/` prefix ([:232](internal/console/runsweep.go#L232)). Thus an idle deployment still incurs an all-app LIST cycle every ten minutes, outside the specified backstop and named non-goals. **Require:** assign orphan discovery a bounded cache/backstop mechanism while preserving time-driven cleanup, or explicitly retain this loop as a non-goal and qualify the scaling claim. Because §3.2 excludes `runs/`, app-generation gating alone would not discover every orphan. |
| + |
| +**Verdict: accept at spec level at `ca129623`, with the P2 cost gaps above. All round-1 P1 blockers are resolved; no new P1 found.** |
| \ No newline at end of file |