carlos / platform Public

Download this file

1	| Finding | Disposition |
2	|---|---|
3	| A2-1 — replication baseline | **Resolved.** Snapshot, level-0 anchor and verification are required before `installed`, matching moves rev 7.6. |
4	| A2-2 — early target replacement | **Resolved.** Replacement preserves release requirements and resumes at the appropriate phase. Replacement execution leases are explicit. |
5	| A2-3 — source reconciliation | **Resolved.** The source remains ready until its admission fence closes, then held through its obligations. |
6	| A2-4 — missed termination events | **Resolved.** Missing evidence explicitly prevents automatic recovery. The new operator fallback introduces A3-1 below. |
7	| A2-5 — continuous-sync deadline | **Partly resolved.** Modification events and a fixed deadline cover open files. However, an unstable file may wait until “the scan,” and a failed watch triggers only one immediate scan. Subsequent writes can therefore wait ten minutes. Require deadline-driven publication or polling while watch coverage is missing. |
8	| A2-6 — manifest permissions | **Resolved.** Immutable objects and replaceable manifests are distinguished. The new enforcement explanation has a separate defect, included in A3-3. |
9	| A2-7 — permanently failing probe | **Partly resolved.** A deadline, replacement path and bounded `stuck` state now exist. Preservation of the failed target’s writes remains incomplete: A3-2. |
10	| A1-1 residual — legacy identity binding | **Partly resolved.** The operator’s tofu check establishes the intended mapping, but the resulting bind object lacks an enforced operator-only writer: A3-3. |
11	| A1-7 residual — wake state | **Resolved.** Continuous publication and restoration now include `NextDue` and `Replication` alongside timer rows. |
12
13	Reviewed `b3821864` against claim rev 6.3 (`8faa89a4`), moves rev 7.6 (`29245f69`) and the nearest-region implementation. H1–H6 remain fixed.
14
15	1. **A3-1 — P1 — §5.9: a CloudTrail termination request is not compute-fencing evidence.** [Location](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md:590)
16
17	**Problem:** The new operator fallback checks a `TerminateInstances` record. That proves an API request occurred, not that execution stopped. Even a successful response can report `shutting-down`; AWS explicitly documents that termination can remain in that state. [AWS API reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_TerminateInstances.html).
18
19	**Failing sequence:** A termination request is accepted while the old executor is still shutting down and running its app. No terminal observation is available. The operator resolves using the CloudTrail request, and the placer starts a replacement before the old process stops.
20
21	**Fix:** Retain claim §7.2’s requirement for verified compute fencing. CloudTrail may help locate the request, but must not substitute for terminal-state evidence. If no qualifying evidence exists, remain `awaiting-evidence`. Reflect this explicitly in K3.
22
23	2. **A3-2 — P1 — §5.8: live probe-failure replacement skips the target’s durability barrier.** [Location](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md:528)
24
25	**Problem:** The new transition obtains stop evidence and resumes at `pinning`, promising to preserve probe writes. Claim §6.1’s stop evidence proves that processes and replicators stopped; it does not establish the final replicated position or file-manifest sequence. The original source’s `flushed` journal entry cannot establish those values for the failed target’s generation.
26
27	**Failing sequence:** A drains to B. During its probe, B creates an application file on a `snapshot` plan, then fails readiness. B produces stop evidence before the next snapshot. The placer pins B’s existing manifest and installs C. C lacks the file even though B remained alive and its data could have been transferred.
28
29	**Fix:** Give `probe-failed` a journaled target-release sequence: close admission, drain, flush the database and **all** file mutations regardless of plan, persist B’s final replication position and manifest sequence, then permit pinning. Require the pin to reach those values. Add this contract to K2 and K8.
30
31	3. **A3-3 — P1 — §§5.1 and 6: the new legacy bind object does not authenticate operator approval.** [Location](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md:201)
32
33	**Problem:** `bound_by.operator` and `tofu_instance_id` are ordinary JSON fields. The spec does not restrict bind creation to an operator principal or require a verifiable operator signature. Section 6 includes binds in the writable `control/boxes/` namespace, while the existing box policy permits writes throughout the deployment bucket. Create-only publication authenticates neither the first writer nor the claimed tofu check.
34
35	**Failing sequence:** Before the legitimate bind exists, a writer using box credentials publishes a legacy-label record containing a valid identity document for another, terminated instance, plus a fabricated `.bind.json`. Readers accept the purported operator binding. Genuine termination evidence for that other instance then authorizes replacement of the still-running legacy executor.
36
37	**Fix:** Make the bind namespace writable only by explicitly authorized operator principals, and bind the attestation to the exact box record. Prevent replacement or deletion that would permit rebinding. Also correct §6’s assertion that S3 cannot enforce conditional headers: AWS supports `s3:if-match` and `s3:if-none-match` policy conditions. Enforce the stated immutability in storage, alongside application checks. [AWS conditional-write enforcement](https://docs.aws.amazon.com/AmazonS3/latest/userguide/conditional-writes-enforce.html).
38
39	4. **A3-4 — P3 — §§1, 4 and 5.4: one cited path is absent and two line anchors need correction.** [Location](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha/docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md:158)
40
41	**Problem and failing sequence:** Following `internal/edge/fleetbind.go` fails because that file does not exist. `homemap.go:529` reaches a role-filtering comment; `reconcile.go:179` states the intended single-box invariant rather than demonstrating the missing enforcement.
42
43	**Fix:** Cite:
44	- `internal/host/fleetbind.go` for binding publication and `internal/edge/edge.go:2432` for per-request fallback.
45	- `internal/edge/homemap.go:538` or `:582` for home-map folding and collision selection.
46	- `internal/provision/reconcile.go:335` and the admission call sites at `:799` and `:936` for region-based admission.
47
48	All code citations were checked against the requested tree. The simulation packages are in the referenced moves worktree, not this commit. No files were changed or tests run.
49
50	**Verdict: not ready.**