amadan
console: name where the placement widening is now refused
The create door's comment described the reconciler as resolving placement record-first. It resolves most-restrictive-first now, so the sentence about why this door accepts no placement field needed the accurate reason: a record that restates the manifest pins itself against a relaxation, and the widening direction is refused at both doors rather than at this one alone.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014WvcQVWggXkE5BAkjRDgWF
1 file changed,
+10
−9
internal/console/apisidecars.go+10 −9
diff --git a/internal/console/apisidecars.go b/internal/console/apisidecars.go| index 5556cc67e..558715819 100644 |
| --- a/internal/console/apisidecars.go |
| +++ b/internal/console/apisidecars.go |
| @@ -195,15 +195,16 @@ func (s *Server) handleAPISidecarGet(w http.ResponseWriter, r *http.Request) { |
| // Every field policy governs is stamped from the MANIFEST, never from the |
| // request. The body has no pool field to lie in, no host field (the host is |
| // derived), and no placement field — that last one deliberately, and it is |
| -// worth stating why: the reconcile pass resolves placement record-FIRST |
| -// (sidecarPlacement), so a record that restated the manifest's placement |
| -// would pin itself against a later change to it, and Task 9's placement |
| -// evacuation — flip the manifest to no-inbound and the rows move — would |
| -// stop working for every record this door ever wrote. Leaving the field |
| -// empty keeps the manifest authoritative, which is what app-wide policy |
| -// means. It also closes the widening an app token could otherwise reach for: |
| -// stating "any" on a record under a no-inbound manifest would place a bot on |
| -// boxes the operator meant to keep it off. |
| +// worth stating why: a record that restated the manifest's placement would |
| +// pin itself against a later RELAXATION of it (sidecarPlacement takes the |
| +// most restrictive of the two), so Task 9's placement evacuation — flip the |
| +// manifest and the rows move — would stop working in one direction for every |
| +// record this door ever wrote. Leaving the field empty keeps the manifest |
| +// authoritative, which is what app-wide policy means. The other direction, |
| +// an app token stating "any" under a no-inbound manifest to place a bot on |
| +// boxes the operator meant to keep it off, is refused HERE and again in the |
| +// reconciler (sidecarPlacement's most-restrictive rule): both doors hold the |
| +// invariant, neither trusts the other. |
| func (s *Server) handleAPISidecarCreate(w http.ResponseWriter, r *http.Request) { |
| principal, acct, app, ok := s.instanceGateFor(w, r, "sidecar") |
| if !ok { |