| 1 | # Astra: review plan 2b (region HA spec 2, joining mode and automatic enrolment) |
| 2 | |
| 3 | **Plan:** `docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md`, 9 tasks. |
| 4 | **Copy record:** `docs/superpowers/plans/2026-10-17-region-ha-2b-copy.md`. |
| 5 | **Spec:** `docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md`, rev 15, especially §5 and §25. |
| 6 | **Plan 2a:** merged as 6834659c. This plan builds on its seams. |
| 7 | |
| 8 | The plan's code was dry-run on main 6834659c and replayed task by task. |
| 9 | |
| 10 | **Controller rulings already made on the plan's open questions:** |
| 11 | - Q2: enrol into the console's own namespace and `default` pool. |
| 12 | - Q5: 2c grants no `DescribeAutoScalingGroups`. |
| 13 | - Q6: enrolling on the invite's confirmation while it is still fresh is acceptable. |
| 14 | - Q1 (who writes a region's `GroupName`/`GroupARN` and initialises the roster) is asked of platform-1e. |
| 15 | |
| 16 | **Judge:** |
| 17 | 1. **Spec coverage for 2b's scope:** |
| 18 | - mode selection; |
| 19 | - joining mode (no edges file, no admission, health 503); |
| 20 | - the enrolment sequence against `internal/hostactors` exactly: attempts, the one-minute confirmation freshness, the invitation, guard-ready, `EnrollAutomatic`, and group-role inheritance; |
| 21 | - the channel-release install with both slots and the floor; |
| 22 | - `host.env` from SSM; |
| 23 | - §25. |
| 24 | 2. **Safety:** |
| 25 | - Can a box admit, serve, or be referenced before it is enrolled and armed? |
| 26 | - Can a non-member be confirmed? |
| 27 | - Can the confirmer or enrolment pass be driven by forged bucket objects? |
| 28 | - Is root's `carlos system join` path safe: the path unit, and guard-arm in process? |
| 29 | 3. **Fail-closed behaviour.** Is every unreadable fact "unknown" and retried, never a definite negative or positive? |
| 30 | 4. **Box-label collisions.** Box references come from the 1,600-value status label space. Under an Auto Scaling group that replaces boxes, how likely is a collision, and what happens then? Is it a P-level issue for 2b? |
| 31 | 5. **Census.** The new authority rows (`runHostEnv`, `channelInstall.run`, the join units), the new legacy rows (`Directory.ConfirmPass`, `AutoEnroller.inputs`) and the re-digests of `runSystem`/`systemVerb`. Is anything unflagged, including in the console claim-authority census? |
| 32 | 6. **Copy.** Does every sentence a person reads have a row? Is the record proportionate, given that it has 61 rows? |
| 33 | |
| 34 | Give findings P1/P2/P3 with plan section or file:line and a failure scenario. End with a verdict: ready to build, or not. |
| 35 | |
amadan