| 1 | Reviewed HEAD `a922d2382c750bdc59410ddf128a40a0772e787c`, read-only. No builds or tests run; working tree unchanged. |
| 2 | |
| 3 | | Round-1 finding | Status | Assessment | |
| 4 | |---|---|---| |
| 5 | | 1. Forged confirmations | **Closed** | H28 removes bucket confirmations from admission. Both APIs take `MembershipReader` and construct confirmation internally. C2’s freshness defect is separate, below. | |
| 6 | | 2. Root-owned update directories | **Partly** | Successful installation now transfers ownership, but retry after a failed ownership handoff can preserve the original defect. | |
| 7 | | 3. Reference collisions | **Open** | Open question 4 records the obstacle correctly. Deferral is acceptable only while automatic enrolment remains dormant. | |
| 8 | | 4. Concurrent seeding overwrites secrets | **Closed** | `SetNew` uses create-only writes; conflicts trigger reread and equality checking. | |
| 9 | | 5. Bootstrap ordering | **Closed** | The script downloads and checksum-verifies the bootstrap executable before invoking it. | |
| 10 | | 6. Console authority census | **Closed** | Construction, start, and invocation are selected and inventoried. | |
| 11 | | 7. Unknown evidence supersedes attempts | **Closed** | Read failures retain the attempt without increasing backoff. | |
| 12 | | 8. Missing unit descriptions | **Closed** | Both descriptions have rows, RHB-C62 and RHB-C63. Approval remains an explicit implementation gate. | |
| 13 | |
| 14 | **Finding 2 remains P2.** In [Task 3’s `cacheDir`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md:1956), ownership is applied only to directories created during that invocation. If `own(top)` fails before changing ownership, cleanup removes the version directory but leaves root-owned `/data/system` and `/data/system/router`. Retrying skips those existing parents and changes ownership only on the recreated version directory. Installation succeeds, but the agent cannot download its next release. Reconcile ownership of the required parents on retries; test a failed handoff followed by a successful retry. |
| 15 | |
| 16 | **Finding 3 may wait for the census ruling, but should block activation.** [Open question 4](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md:6160) should explicitly require the reference fix before enabling automatic enrolment/replacement. Its claim that collisions heal through replacement overlooks the [first-build exception](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md:215): a target group that has never been healthy need not trigger replacement. An alarm reports that stall; it does not repair it. |
| 17 | |
| 18 | New findings: |
| 19 | |
| 20 | 1. **P2 — Membership freshness is checked before intervening I/O, not at the write.** |
| 21 | [Task 4’s enrolment hook](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md:2858) checks freshness before `Directory.Replace`. However, [`Replace`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/internal/hostactors/roster.go:249) subsequently calls `checkMembership`, which reads the floor, report, and release evidence before the roster CAS. Similarly, [Task 5’s invitation check](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md:3735) precedes `Invite`’s bucket read and signing. |
| 22 | |
| 23 | A describe can pass at age 59 seconds, followed by a slow successful bucket read, then an invitation or enrolment written after 60 seconds. This violates C2. Put the final check after intervening reads/signing, immediately before each `Store.Put`. Tests should advance time inside those downstream reads; the proposed ticking-clock tests stop before this gap. |
| 24 | |
| 25 | 2. **P2 — The seeding permission contract omits decryption.** |
| 26 | [2c seam 4](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md:6150) grants `PutParameter`, `GetParametersByPath`, and `kms:Encrypt`, but [`ByPath`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md:1264) always requests decrypted values. With exactly those permissions, seeding another region or resolving a concurrent-create conflict fails when reading existing shared SecureStrings. AWS requires `kms:Decrypt` for that retrieval. [AWS documentation](https://docs.aws.amazon.com/systems-manager/latest/userguide/ps-restrict-decryption.html) |
| 27 | |
| 28 | Add scoped decryption permission to the operator contract and update RHB-C61, which also omits the SSM read permission. |
| 29 | |
| 30 | For the remaining claim-owner conditions: C1 is satisfied; C4 is correctly specified for 2c, including negative permission tests. C3’s existing placement/capacity readers exclude validated fences and stale evidence. The stop/start guard still needs the promised dev verification: AWS documents `pendingTime` as launch time, but does not explicitly establish the exact stop/start-versus-reboot invariant asserted here. Keep Open question 7 as an activation gate. [AWS identity-document documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html) |
| 31 | |
| 32 | --- |
| 33 | |
| 34 | **FIRST PROMPT:** |
| 35 | Round 2 review of region HA 2b at a922d238, against round 1 and H28. |
| 36 | |
| 37 | **WHAT:** |
| 38 | Reviewed the revised plan, spec, and supporting code paths. |
| 39 | |
| 40 | **STATUS:** |
| 41 | Six findings closed, one partly closed, one open; two new P2 findings. |
| 42 | |
| 43 | **NEEDED:** |
| 44 | The recorded census ruling for the reference change. |
| 45 | |
| 46 | **RECOMMENDED:** |
| 47 | Fix write-time freshness, retry ownership, and seeding permissions; gate activation on references and restart verification. |
| 48 | |
| 49 | **SESSION:** |
| 50 | Safe to close. No files changed or processes started. |
| 51 | |
| 52 | **Verdict: not ready to build.** |
amadan