amadan
spec: region HA spec 1 rev 5.2, Astra round 3 findings (unedited)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+68
−0
docs/superpowers/specs/CODEX-FINDINGS-REGION-HA-REV5-3.md+68 −0
diff --git a/docs/superpowers/specs/CODEX-FINDINGS-REGION-HA-REV5-3.md b/docs/superpowers/specs/CODEX-FINDINGS-REGION-HA-REV5-3.md| new file mode 100644 |
| index 000000000..8ae84df84 |
| --- /dev/null |
| +++ b/docs/superpowers/specs/CODEX-FINDINGS-REGION-HA-REV5-3.md |
| @@ -0,0 +1,68 @@ |
| +| Prior finding | Disposition | Answer in rev 5.2 | |
| +|---|---|---| |
| +| B2-1 | **Partly resolved** | §6 denies root replacement, snapshots and images. Direct volume copying remains unguarded; deletion can also retain recoverable volumes. B3-1 and B3-2 below. | |
| +| B2-2 | **Partly resolved** | §5.9 adds revocation and a post-barrier record. Concurrent revocations and outstanding service workflows remain unspecified. B3-4 and B3-5. | |
| +| B2-3 | **Partly resolved** | §6 replaces the impossible service-role assertion with initiating-API controls. Their resource scope leaves another-group attachment open. B3-3. | |
| +| B2-4 | **Resolved** | §5.6 and §5.8 select the files pin independently and protect its manifest and referenced objects through retirement; L13 carries the amendment. | |
| +| B2-5 | **Resolved** | §5.8 binds receipts to `op.journal.install_stamp` and explicitly forbids remaking the initial installation after admission. | |
| +| B2-6 | **Resolved** | §5.1 requires positive terminal reads for every remaining active or quarantined enrollment, then rechecks coverage at enrollment. These reads grant no fencing authority. | |
| +| B1-2 | **Resolved** | §5.8 separates replacement-local installation from the remote build and preserves receipt validity across subsequent admissions. | |
| +| B1-3 | **Partly resolved** | §5.9 supplies holds and removed-volume accounting; the release residuals are B3-4 and B3-5. | |
| +| B1-4 | **Partly resolved** | §6 protects direct tag writes and requires an attestation. B3-1–B3-3 leave gaps in the destroyed-disk proof. | |
| +| B1-8 | **Resolved** | §5.1/L19 removes the enrollment/fencing cycle while keeping H17’s cross-region use limited to confirmation. | |
| + |
| +Reviewed `075d709f` against claim `98b45332`, moves `a4711728`—the latest committed spec in the supplied worktree—and code at `origin/main` `09814f7f`. H1–H18 and claim R6 remain fixed. |
| + |
| +1. **B3-1 — P1: Recycle Bin can preserve volumes deleted on termination.** |
| + |
| + **Sections:** [§5.9’s fence conditions](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md:958), §6’s guard attestation. |
| + |
| + AWS explicitly includes volumes deleted by instance termination or root replacement in Recycle Bin protection. Such volumes remain recoverable. Neither the guard nor its attestation checks retention rules. This is a missing mechanism for H10’s requirement that the disk die, without changing that ruling. [AWS retention behavior](https://docs.aws.amazon.com/ebs/latest/userguide/recycle-bin-factors.html), [recovery semantics](https://docs.aws.amazon.com/ebs/latest/userguide/recycle-bin-concepts.html). |
| + |
| + **Failing sequence:** A region has a matching volume-retention rule. A tagged box has a fresh all-true volume record and a valid guard attestation. It terminates; its volumes enter Recycle Bin. Every specified fence check passes, so local chores are discharged although the artifacts remain recoverable. |
| + |
| + **Suggested fix:** Require attested, protected exclusion from every applicable volume-retention rule. Cover changes to those rules and their selection tags. Where exclusion cannot be established, retain the operator path. Include retained snapshots and images when validating destruction during hold release. |
| + |
| +2. **B3-2 — P1: `CopyVolumes` bypasses the new disk-copy guard.** |
| + |
| + **Section:** [§6, volume guard](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md:1283). |
| + |
| + The new snapshot/image denies omit `ec2:CopyVolumes`. AWS supports copying an encrypted, in-use volume directly. The copy receives another volume ID, does not inherit source tags, and completes even if the source is deleted. This path needs no snapshot or attachment change. [AWS volume-copy contract](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-copying-volume.html), [API authorization](https://docs.aws.amazon.com/service-authorization/latest/reference/list_ec2.html). |
| + |
| + **Failing sequence:** A principal with volume-copy and applicable KMS permissions copies a platform disk without a hold. The original remains attached with `DeleteOnTermination: true`; subsequent volume records remain valid. Termination deletes the original, but the independent copy survives. The fence nevertheless discharges local retirement. |
| + |
| + **Suggested fix:** Include direct volume copying in the enforced guard and attestation. Specify an enforceable source-resource restriction, rather than assuming the existing tag condition applies unchanged. Any permitted copy must belong to a hold and be accounted for before release. Rehearse this path explicitly. |
| + |
| +3. **B3-3 — P1: Another Auto Scaling group can overwrite a platform instance’s protected tag.** |
| + |
| + **Section:** [§6, initiating-API deny scope](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md:1306). |
| + |
| + `AttachInstances` is denied only on the deployment’s platform groups. AWS authorizes this action against the destination group, and attachment propagates that group’s tags onto an existing instance, overwriting matching keys. The service-linked role performs those writes outside the SCP. [Authorization scope](https://docs.aws.amazon.com/service-authorization/latest/reference/list_autoscaling.html), [attachment tagging behavior](https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-tagging.html). |
| + |
| + **Failing sequence:** A fixed platform box has a valid record. An otherwise authorized principal attaches it to another group whose propagated `carlos:role` value is different. That destination is outside the deny. The service overwrites the instance tag, making the instance-conditioned root-replacement deny ineffective. The principal replaces its root while retaining the original, then terminates it before another volume observation. The old record qualifies although the original disk survives. An Auto Scaling box can first be detached; `DetachInstances` is also absent from the list. |
| + |
| + **Suggested fix:** Cover every group capable of acquiring a platform instance, including fixed boxes. If AWS cannot express the required source-instance restriction for attachment, use an account-wide attachment restriction with a controlled hold workflow. Test attachment to an unrelated group, not only requests against the platform group. |
| + |
| +4. **B3-4 — P1: Concurrent releases can move the shared revocation cutoff backwards.** |
| + |
| + **Section:** [§5.9, release step 1](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md:1048). |
| + |
| + AWS’s referenced revocation mechanism updates an inline policy containing a timestamp. `PutRolePolicy` replaces that policy; it supplies no conditional revision check. The spec uses one volume-change role across holds but defines no monotonicity or serialization for these updates. [AWS revocation mechanism](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_revoke-sessions.html), [`PutRolePolicy`](https://docs.aws.amazon.com/IAM/latest/APIReference/API_PutRolePolicy.html). |
| + |
| + **Failing sequence:** Release A submits cutoff `R1`, but its request pauses. Change B obtains credentials after `R1`; release B installs cutoff `R2 > R1`. A’s delayed request then replaces the policy with `R1`. B completes its fifteen-minute wait, validating observations and release. B’s credentials now remain authorized because they were issued after `R1`. Its paused change process resumes, detaches a disk, and termination precedes the next observation. B’s closed hold permits a false fence. |
| + |
| + **Suggested fix:** Specify revocation that cannot weaken under concurrent completion or replay. Independently retained per-hold denies, or isolated change roles, can avoid replacing another hold’s barrier. Retain each denial until every credential it covers has expired. Test reversed request completion and crash recovery. |
| + |
| +5. **B3-5 — P2: The release barrier omits outstanding Auto Scaling workflows.** |
| + |
| + **Sections:** [§5.9, release step 2](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md:1054), §6’s permitted operator refresh. |
| + |
| + The barrier checks current EC2 tasks, attachments, snapshots and images. It does not check the Auto Scaling workflow that may issue a later task. Refreshes can pause at checkpoints or lifecycle hooks. Revoking the initiating operator session does not revoke the service-linked role’s authority. [Refresh checkpoints](https://docs.aws.amazon.com/autoscaling/ec2/userguide/instance-refresh-overview.html), [root-replacement lifecycle hooks](https://docs.aws.amazon.com/autoscaling/ec2/userguide/replace-root-volume.html). |
| + |
| + **Failing sequence:** An operator starts a root-volume refresh under holds. It pauses before replacing box A’s root. A has no active EC2 replacement task, and its mapping remains all-true. Release revokes the operator session, waits fifteen minutes and accepts validating records. The refresh later resumes and changes A’s disk after its hold was released. |
| + |
| + **Suggested fix:** Journal initiating service-operation IDs and require terminal completion or confirmed cancellation before releasing affected holds. Keep every affected enrollment suspended throughout group-wide work. Also use an explicit terminal-state allowlist: EC2 root-replacement states `failing` and `failing-detached` are not terminal, despite passing the current exclusion of only `pending` and `in-progress`. [EC2 task states](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceRootVolumeTask.html). |
| + |
| +No files were changed or tests run. AWS failure sequences above are derived from the documented contracts, not live experiments. |
| + |
| +**Verdict: not ready for plan.** |
| \ No newline at end of file |