carlos / platform Public

Download this file

1	Three new findings:
2
3	1. **P1 — Operator approval does not remove the AWS identity requirement.**
4	[Spec:557](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md:557) delegates non-AWS enrolment to existing `hostactors.Enroll`. That path still requires `AWSRegion` and verifies an AWS-signed identity ([enroll.go:29](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/hostactors/enroll.go:29)). Roster validation explicitly requires `Cloud.Provider == "aws"` ([roster.go:111](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/hostactors/roster.go:111)), and hosting re-verifies the AWS evidence ([identity.go:45](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/hostbox/identity.go:45)).
5
6	**Failure scenario:** an operator approves a bare-metal host with MinIO and configured addresses, but it cannot enrol or enter hosting mode. The membership-confirmer interface does not cover this separate identity dependency. Specify a provider-neutral identity contract through enrolment and admission, preserving reference uniqueness and replacement isolation.
7
8	2. **P2 — “Unchanged” placement still excludes non-AWS hosts.**
9	[Spec:554](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md:554) treats placement as provider-neutral because it calls no cloud API. However, [`boxchoice.Eligible`:110](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/boxchoice/boxchoice.go:110) requires an AWS region and `Cloud.Complete()`, which explicitly requires provider `aws` ([verify.go:30](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/boxid/verify.go:30)).
10
11	**Failure scenario:** even after adding non-AWS enrolment, both healthy hosts remain ineligible and every create stays pending. Separate placement-region membership from AWS evidence. These checks already import no AWS SDK, so the proposed import test cannot enforce that distinction.
12
13	3. **P2 — The no-AWS test omits a lifecycle write that still targets AWS.**
14	[Spec:575](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md:575) requires enrolment, placement, forwarding and health checks, but no actual generation publication. The production marker client uses plain `s3.NewFromConfig`, without the `s3compat.Options()` that applies `CARLOS_S3_ENDPOINT` ([claimproduction_marker.go:21](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/host/claimproduction_marker.go:21)).
15
16	**Failure scenario:** with MinIO configured through `CARLOS_S3_ENDPOINT`, ordinary bucket operations succeed, but generation publication sends its write to AWS and fails ([claimowners.go:586](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/host/claimowners.go:586)). Classify compatible-store transport explicitly and require the no-AWS test to exercise production admission, generation publication and relocation, with unexpected AWS/IMDS requests rejected.
17
18	Reviewed platform `d2361b2a` and flagship `7c99ff8f`. No files changed; no builds, tests or infrastructure commands run.
19
20	---
21
22	**FIRST PROMPT:**
23	Review spec 2 round 13 at the pinned HEAD against flagship tofu, read-only.
24
25	**WHAT:**
26	Check the provider boundary and no-AWS fallback.
27
28	**STATUS:**
29	Review complete: one P1 and two P2 findings.
30
31	**NEEDED:**
32	Nothing.
33
34	**RECOMMENDED:**
35	Resolve the identity, placement and compatible-store gaps before planning.
36
37	**SESSION:**
38	Safe to close; nothing modified or started.
39
40	**Verdict: not ready for a plan.**